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Preface 



Services represent the fastest growing sector of the economy in industrialized 
nations. Services science, introduced by IBM in 2002, arises from the rapid de- 
velopment of services across the industrial world and the need to analyze and 
study the organization, deployment, maintenance and operation of those related 
IT-based and IT-supported services. Services science represents an interdisci- 
plinary approach to the systematic innovation in service systems, integrating 
management, social, legal and engineering aspects to address the theoretical and 
practical aspects of the challenging services industry and its economy. Services 
science leverages methods, results and knowledge stemming from these disci- 
plines toward the development of its own concepts, methods, techniques and 
approaches thus creating the basis for true transdisciplinary gatherings and the 
production of transdisciplinary results. Services science is building a concrete 
framework for transdisciplinary purposes. The conference on Exploring Services 
Science (IESS) is now an established conference where researchers from around 
world present innovative ideas, research and applications in the design, exper- 
imentation and management of services. The Third IESS Conference was held 
at the University of Geneva, February 15-17, 2012. The main theme was the 
transdisciplinary services approach. The papers presented ideas and issues re- 
lated to the innovation, services management, services engineering and services 
discovery. 

The conference attracted 46 papers from 22 countries and the program com- 
mitte accepted 22 full papers (from p.l to p.310) and 6 short papers (starting 
from p.311). Given the novelty of the domain of services science we would like 
to acknowledge and thank all the authors for their contributions and their trust 
and the Program Committee members for their valuable and professional work 
in reviewing the submissions and crafting the program of this third IESS confer- 
ence. The conference featured the keynote presentation of Gerhard Stazger from 
KIT, Germany. Following the conference a half-day societal forum was held and 
addressed issues in the areas of innovation in services. 

We would like to thank the Program Committee members and the referees 
who reviewed the submitted papers as well as the local Organizing Committee 
and institution (Institute of Service Science, UNIGE, Switzerland) for all the 
effort and support in setting up and organizing the conference. We wish you a 
pleasant reading and a fruitful use of these research results in your research and 
applications. 
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Towards a Process Model for Service Systems 



Elisah Lemey and Geert Poels 



Center for Service Intelligence 
Faculty of Economics and Business Administration 
Ghent University 

Tweekerkenstraat 2, 9000 Gent, Belgium 



Abstract. Service Science is a new interdisciplinary approach to the study, 
design, implementation, and innovation of service systems. However due to the 
variety in service research, there is no consensus yet about the theoretical 
foundation of this domain. As a basis for a common understanding of service 
systems and their interactions. Service Science researchers Spohrer and Kwan 
proposed the service systems worldview. The ISPAR model was presented as a 
part of this service systems worldview as a tool for identifying ten possible 
interaction episodes, i.e., the sequences of activities that are undertaken by two 
interacting service system entities. In this paper we evaluate the use of the 
ISPAR model as a process model for service systems. We identify the 
shortcomings of the ISPAR model and propose possible improvements. This 
analysis leads to the development of a new service process model which is 
demonstrated through tree different examples. 

Keywords: Service Science, SSME, service system, service process model, 
ISPAR model. 



1 Introduction 

The research presented in this paper is part of a research project that investigates the 
theoretical foundation of Service Science which is a new interdisciplinary field that 
studies the structure and behaviour of service systems. Due to the variety in existing 
service research (e.g., services marketing, services management, service design, 
service-oriented computing), there is no consensus yet about which theories and 
frameworks could serve as a scientific basis for this domain [1-5]. 

As a starting point for our research, we took the service systems worldview of 
Spohrer and Kwan [6] . The service systems worldview was proposed as a candidate 
shared conceptualization for Service Science researchers. The authors propose a 
domain model that consists of ten foundational concepts and explains the diversity 
and complexity of service systems. In addition, Spohrer and Kwan introduce a 
process model, i.e., the ISPAR model as a normative model of all possible service 
system interaction outcomes to better understand the dynamics of service systems [7]. 

In [8], we clarified the ten foundational concepts by investigating them from the 
perspective of established service theories and frameworks. By mapping the 
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proposed service system concepts on the service theories and frameworks, we 
clarified their theoretical foundations, examined their definitions, identified 
possible conflicting interpretations, and discovered their likely relationships and 
general structure. 

This paper elaborates on the process orientation of the service systems 
worldview. The ISPAR model shows ten possible interaction episodes, i.e., 
sequences of activities that are undertaken by two interacting service system entities 
[7]. Each of these interaction episodes is associated with a particular outcome, 
which can be a desired or non-desired result of the interactions. We believe that the 
ISPAR model component of the service systems worldview has shortcomings when 
used as a process model for describing the interaction of service system entities. As 
we will explain, the ISPAR model lacks structure and clarity which is an obstacle in 
analysing service processes established by two (or more) interacting service system 
entities. 

The aim of this paper is to refine the ISPAR model to a normative process model 
for service systems. In the remainder of this paper, we will try to answer two clear- 
cut research questions. The first research question that needs to be answered is: 
What is a normative service process model for service systems? Therefore, the 
ISPAR model is evaluated and four important shortcomings are defined. For each of 
these shortcomings, we propose a candidate solution. Our research method 
consisted of comparing the ISPAR model with two established service process 
models or frameworks which serve as a good basis for the comparison but are in 
itself incomplete with respect to their coverage of possible interaction episodes 
between service system entities. We identified which elements from these 
alternative models or frameworks can be incorporated to further refine and extend 
the ISPAR model. 

The second research question is: How to represent such a normative process 
model? As an answer to this question we propose new graphically represented service 
process model for Service Science that meets the characteristics defined by the first 
research question. The model is designed as an Event-driven Process Chain (EPC). As 
it is largely based on the ISPAR model, it includes all the originally proposed 
interaction episodes. However, it also includes some new elements which should 
serve as an answer to the identified shortcomings. 

Section 2 gives a thorough description of the ISPAR model as proposed by Spohrer 
and Kwan. In section 3 we evaluate the model by highlighting the most important 
shortcomings of the model. Section 4 presents possible solutions for these 
shortcomings. Section 5 then redefines the ISPAR model by using an EPC 
representation. Next, we demonstrate the new service process model in section 6. 
Finally, section 7 presents a conclusion and future work. 



2 The Service Systems Worldview 

In [8] we investigated the proposed foundational concepts of the service system 
worldview from the perspective of established service theories and frameworks 
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used in service marketing, service management, service operations and service 
computing research. Based on this investigation, we identified relationships 
between the foundational concepts and visualised this structure in a conceptual 
model (in the form of a UML class diagram). Figure 1 shows the developed model 
of the ten foundational concepts to explain the diversity and complexity of service 
systems: entity, resource, access right, ecology, interaction , value proposition 
based interaction, governance mechanism based interaction, outcome, measure, 
and stakeholder [9]. 




Fig. 1 . UML Class diagram of the service systems worldview [8] 



The ISPAR model deals with some of these concepts. It is a prescriptive model that 
considers all possible interactions and their corresponding outcomes between 
different sendee system entities. As there exists a great variety of different types of 
service interactions, the ISPAR model makes abstraction of this complexity by 
categorizing interaction episodes according to their outcome [10]. By mapping actual 
sequences of interactions onto the model, it becomes possible to evaluate a service 
system’s quality (i.e., a specialisation of measure in Fig. 1). Quality can be expressed 
as the ratio of successful service outcomes to all other interaction outcomes of a 
service system. Moreover, the ISPAR model permits the mapping of (service) 
interactions of every possible kind of service system [11], It is suited for typical value 
proposition based interactions between provider and customer which assume a value 
proposition that indicates how the interaction will lead to mutual value co-creation 
(i.e., what is called sendee in Fig. 1). However, it also provides a manner to model the 
outcomes of so called governance mechanism based interactions which occur in the 
context of collective interest, i.e., when the interaction is regulated by a governing 
body like auctions or court cases [6]. 

To show the ten possible interaction episodes and outcomes, the ISPAR model is 
represented as a branch model (Fig. 2) [7], Realization (R) is the most desired 
outcome. In this case the value proposition is successfully proposed, agreed upon and 
realized, and the outcome is mutual value co-creation. 
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I - interaction 

S ” Service interaction 

-S - Not a service interaction 

P = Proposal communicated 

-P = Proposal not communicated 

A - Agreement 

-A = Agreement not reached 

R = Realized value co-creation 

-R - Not realized value co-creation 



0 - Dispute 
- D - Not disputed 
K = OK resolution for all interested 
-K = Not OK resolution for interested 
W - Welcome non-service interaction 



W = Not welcome non service interaction 
C ” Criminal (illegal) inter action 
C — Not criminal interaction 
J ■ Justice realized 
J - No justice realized 



(as judged by one or both service systems. 




Fig. 2. The ISPAR model of service system interactions [7] 



To reach outcome R two service system entities have to engage in interactions (I) 
which classify as service interactions (S) during which a proposal has to be 
communicated (P) and the service system entities have to reach an agreement about 
the service (A). If the service proceeds as agreed, it is said that the service is realized 
(R). However, the ISPAR model indicates that the service systems worldview is not a 
happy path theory but also takes into account other outcomes that deviate from mutual 
value co-creation. A service proposal may not be successfully communicated or 
understood by a service system entity (-P) or two service system entities may not 
come to an agreement about the proposal (-A). Another option is that mutual value 
co-creation is not realized as agreed. In this case a dispute may (D) or may not (-D) 
arise. A dispute can lead to two possible outcomes. Either the dispute is successfully 
resolved for all stakeholders (K) or the proposed solution is not acceptable for at least 
one stakeholder (-K). 

When an interaction doesn’t qualify as a service interaction (-S), it can be welcome 
(W), e.g., when saying hello to a colleague at work. However, a non-service 
interaction can be unwelcome (-W), e.g., when a restaurant discovers that two clients 
have been assigned to the same table. If this non-service interaction is not a criminal 
act (-C), the interaction sequence ends at that point. If it concerns a criminal activity 
(C) like theft, this can result in justice (J) if the criminal is punished or in no justice (- 
C) if the lawbreaker manages to escape. 

As the aim of this paper is to provide service researchers with a clear service 
process model that enables the analysis and improvement of the service process, the 
interaction episodes that are composed of non-service interactions will be left aside. 
The service process model we aim at will thus only cover situations in which mutual 
value co-creation is the purpose of engaging into interactions with other service 
system entities. 
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3 Evaluation of the ISPAR Model 

Although the ISPAR model gives a comprehensive overview of the possible 
interaction sequences between two service system entities, the model does not serve 
as a good process model. Overall, the model lacks clarity and structure which makes 
it difficult to analyse service processes. We can identify several obstacles to the use of 
the ISPAR model as a normative service process model. 

First, a good process model should emphasize all important activities that take 
place during the process. However, in the ISPAR model the propose and agree 
activities present a necessary (even if sometimes implicit), but often (though not 
always) a relatively minor part of the service process, while the realize activity 
comprises in many cases the main part of the service process. We believe that the 
realize component of the model is not specific enough and doesn’t show the 
complexity of the realization of a service. If a company has a maintenance contract 
for the elevators of a building, the service realization interactions may be spread over 
several years and range from the monthly maintenance to a phone call from the sales 
department to extend the contract. As the type of services performed can differ 
strongly, the realize activity should be further refined. 

Second, according to the ISPAR model a service proposal is very concrete and 
direct, e.g., a service contract which is signed by both provider and customer. 
However, by using this limited view on proposals, a lot of potential service 
interactions are excluded from the analysis. A television commercial for a university 
could serve as a first proposal from that university to potential students, which are at 
the moment of broadcasting not individually identified and maybe not even aware of 
the service offer. We believe that a broader interpretation of the propose activity, i.e., 
not necessarily involving two explicitly identified service system entities that 
purposefully interact and are both aware of the service need and offer, could enable a 
more complete analysis of service processes. 

Third, Spohrer and Kwan state that the ISPAR model shows service system 
interaction episodes which describe the sequence of activities that might be pursued 
by two interacting service system entities [11]. However, a few elements indicate 
that the ISPAR model may not be suited to describe the sequence of activities. Only 
the propose (P), agree (A) and realize (R) nodes of the model are real activities 
(where R is at the same time an outcome). The interact (I) node has no real meaning 
other than being the source of all further offspring. The S and -S nodes describe 
types of interaction episodes, i.e., sequence of service or non-service interactions. 
The ISPAR model thus mixes the overview of possible outcomes with the actual 
process flow. 

Fourth, in the ISPAR model every path leads to a different outcome. However, 
we believe it is possible that the same outcome is reached through different paths. 
We use the example of a consulting service to clarify our point. A consulting firm 
makes a proposal to a customer (P) and reaches an agreement with that customer 
about this proposal (A). After fulfilling the proposed services, the consulting 
company invoices the customer. If the customer pays as agreed, mutual value co- 
creation is reached (R). However, if the customer does not pay, the outcome 
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according to the ISPAR model would be -R. In an attempt to solve this problem 
(D), the consulting firm would send a reminder to the customer. If the customer 
pays the invoice after receiving the reminder from the provider (K), mutual value 
co-creation is still reached. So in that case, outcome K is the same as outcome R. In 
a good process model, these two paths would lead to the same end state. The same 
goes for the process nodes -P and -A. Although these nodes are outcomes in the 
ISPAR model, we argue that a badly communicated proposal can be set right by the 
decision to reiterate the proposal episode. Thus, the service process can still have a 
successful outcome. However, this cannot be read from the ISPAR model as it 
doesn’t provide any return paths. 



4 Proposed Improvements for the ISPAR Model 

To propose improvements for the ISPAR model, we will formulate some ideas or 
strategies to counter each of the comments above. For the first tree comments, we 
evaluate two established service process frameworks. The first framework is a part 
of Alters’ work system method which is a business-oriented system analysis and 
design tool [12]. The work system framework uses nine basic elements to provide a 
system view of the organisation [12]. Next to this work system framework, Alter 
proposes the service value chain, which elaborates the work system framework with 
service-oriented insights [2]. It presents a two-sided view of the service process as 
the service is coproduced by customer and provider. It shows the different steps that 
should be executed in a service process. Alter shows the different kinds of 
interactions that emanate from a value proposition (figure 3). First, customer- 
provider contact is based on awareness. The provider should create awareness 
among customers about the existence of the service. The customer should become 
aware of a need that has to be filled. Next, provider and customer will engage in a 
negotiation about commitment to the service. The ISPAR model of the service 
systems worldview also recognizes these two types of interaction (i.e., proposal and 
agreement) which show how the service process is initiated, but as already 
mentioned does not further distinguish between different types of interaction that 
occur when the rest of the service process is executed (i.e., realisation). The service 
value chain model further defines these interactions or service encounters. The 
customer makes a service request which is handled and fulfilled by the provider and 
the customer participates in this fulfilment. Finally, both customer and provider 
follow up the handling of the service. 

The second framework is the sendee ontology based on the DOLCE upper-level 
ontology of Ferrario and Guarino [13]. As can be seen in figure 4, a service is 
conceived as a complex event with five main parts: service commitment, service 
presentation, service acquisition, service process and service value exchange. A key 
concept in the service ontology is the commitment of an agent to guarantee the 
execution of a service at a certain place and time. The authors strongly focus on 
commitment which they consider as the core of a service. However, commitment here 
has a different meaning than commitment defined by Alter. Here commitment implies 
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more than just agreeing to a value proposition. A value proposition is usually the 
result of negotiations between provider and customer. Therefore the customer has 
already decided he wants a certain service. Service commitment according to Ferrario 
and Guarino means the willingness to perform a service on the side of the service 
provider without needing the involvement of the customer. This implies that service 
can exist even before the occurrence of interactions between provider and customer. 
So, the commitment of the provider to guarantee the production of a service content is 
the first step in the service process. 




Provider’s Responsibilities 
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Create 
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Fig. 3. Alters’ service value chain framework [14] 



Nevertheless, commitment is not sufficient to initiate the actual service execution 
as it only indicates willingness on the side of the provider. Hence, a triggering 
event is included. Provider entities should be notified of the occurrence of this 
event in order to know when the service should be executed. After the occurrence 
of the triggering event, the provider should bundle his services and present them to 
the customer. Then, service acquisition takes place at the side of the customer. 
After negotiating the service offer, the provider produces the service content. In 
order to produce the service, both customer and provider should sacrifice 
something, e.g., the provider sacrifices time and effort into realizing the service 
while the customer has to sacrifice money and possible other resources like 
his time. 
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Service commitment 



Service bundling and presentation 






Service acquisition 



Service discovery 



Service negotiation 



Service activation 




Fig. 4. The layered structure of service activities of the service ontology [13] 

In our first critique on the use of the ISPAR model as a normative service process 
model, we suggested that the realise activity should be elaborated. Possible 
improvements can be found in the service value chain of Alter which identifies three 
different steps. First, the customer has to make a request which is handled by the 
provider. We believe this step may be important as agreement about a service does 
not always mean that the service is realized immediately. Next, customer and provider 
participate in the fulfilment of the service. Finally, customer and provider engage in 
some follow-up activities. The service ontology of Ferrario and Guarino also provides 
us with some useful insights. The authors also indicate that service agreement doesn’t 
automatically lead to service execution. The occurrence of a triggering event is seen 
as a signal for initiating the service. However, the triggering event doesn’t always 
have to be a customer request. For example, it could also be snowy weather which 
activates a snow removal service. 

The second obstacle that we identified dealt with the interpretation of the propose 
activity. We notice that the propose activity is defined differently by the various 
service process frameworks. As already mentioned, in the ISPAR model a service 
proposition is very concrete and direct. Both the service value chain framework of 
Alter and the service ontology of Ferrario and Guarino provide us with a broader view 
of the proposal concept. We note that Alter uses a broader definition as the creation of 
awareness can also be done by broadcasting a commercial on television. Ferrario and 
Guarino introduce the concept of commitment which also indicates a broader 
understanding of the propose activity. According to the service ontology a fire 
department makes a commitment by simply existing and being prepared to provide 
help in case of a fire. Therefore the proposal is already done. However, as the service 
ontology of Ferrario and Guarino has a different definition of service which doesn’t 
match the vision of the service systems worldview (see [8] for a comparative analysis 
of service definitions), we choose to adopt the interpretation of Alters service value 
chain. According to Ferrario and Guarino service equals commitment. We believe that 
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this vision is suited for governance mechanism based interaction, e.g., a fire 
department, but doesn’t account for value proposition based interactions that are 
typically found in business, e.g., the mere existence of a kiosk doesn’t commit the 
kiosk owner to sell newspapers to customers passing by. 

The third comment stated that the ISPAR model mingles activities with outcomes. 
This is confirmed by looking at the service value chain framework of Alter and the 
service ontology of Ferrario and Guarino. Both frameworks roughly identify a 
propose, agree and realize episode. Interaction and service interaction are not part of 
the models as separate activities. Alter indicates that each contact between customer 
and provider, e.g., interaction is a service encounter. This confirms our statement that 
every propose, agree or realize activity requires one or more interactions [5]. We can 
conclude that the ISPAR model should be redefined so that activities and possible 
outcomes or states of the system are separated from each other. To model the service 
process we propose the use of an EPC process model [15]. The EPC technique is a 
well-known Petri Net based process modeling technique. The basic building blocks of 
an EPC are events and functions. Functions describe an activity or task that leads 
from one event to another. An event describes the state of the process at a certain 
moment. In an EPC functions and events alternate each other. A Function is 
represented by a rectangle and an event by a hexagon. The events and functions can 
be connected through logical operators as XOR, IOR and AND. 

To tackle the fourth comment we propose to change the representation of the 
ISPAR model. The service process model should be built in such a way that on the 
one hand paths which lead to the same end state are aggregated at some point in 
the process model and on the other hand return paths are provided to restore the 
service process in case of failure. The new representation of the service process 
model, i.e., the EPC, provides us with the opportunity to incorporate this feature 
into the model. 



5 Service Process Model 

Figure 5 shows our proposal for a normative service process model based on the 
ISPAR model. In this model three possible outcomes can be identified: service 
aborted, service successfully ended, and service not successfully ended. All possible 
interaction paths in this service process model will eventually end in one of these 
three final states. As explained in section 4, we have chosen to work with an EPC 
representation of the service process model. The model allows us to separate 
functions (or interactions) from events (including ISPAR outcomes). All ten 
interaction episodes from the ISPAR model are included in the EPC. 

The model starts with the event ‘customer is aware of service need or offer’. This 
event accounts for both a push scenario in which the customer seeks a provider to 
fulfil a service need as a pull scenario in which a provider persuades the customer that 
a certain service might be useful. In both scenarios the provider possesses resources 
or access rights to resources that the customer needs or wants. This is in fact the 
reason for all service interaction. Customers become aware of a certain need or want 
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but do not possess the necessary resources. Therefore a service process is initiated by 
the customer (push scenario) or the provider (pull scenario) in which all kind of 
resources are traded. Not only technology or natural resources but also information or 
competences are resources a provider might possess. 

After this first event, which is the starting point of any service process depicted 
with our model, the activity ‘propose service interaction’ is performed. As explained 
above, we choose to adapt the service proposal interpretation of Alter in which a 
proposal is not narrowly defined, but can be anything that will eventually lead to an 
agreement between two interacting service system entities. If this activity fails and the 
service proposal is not successfully communicated or understood, this can lead to the 
outcome ‘service aborted’. However, unlike the ISPAR model, our service process 
model provides a return path. This return path makes it possible to decide to revise 
and reiterate the service proposal. 

If the proposal is successfully communicated and understood, the two service 
system entities can move on to ‘agreeing to the service proposal’. Again, in case of 
failure, the service process can be aborted at this point or the service system entities 
can decide to revise the agreement. After an agreement about the service proposal is 
reached, the service execution should be initiated. The initiation signal which is 
mentioned in the service process model, can be compared to the triggering event in 
the service ontology of Ferrario and Guarino. However, the initiation signal could 
be a signal given by the customer or the provider or the occurrence of an event that 
starts the service realization. If the initiation signal is not sent or received, the 
service system entities could decide to revise the initiation signal. This return path 
provides an opportunity for the service system entities to choose a new initiation 
signal or detection method. If the initiation signal is not revised, the service is 
aborted. 

If the first three activities (propose service interaction, agree to service proposal, 
and initiate service execution) in the process model succeed without problems, the 
service realization activity can start. This is the core activity of the model as this is the 
execution of the service content as defined by the agreement. The outcome of this 
activity is judged by both service system entities through different measures. If the 
service is successfully realized, both service system entities perform follow-up 
activities. In this model, the follow-up activities are seen as internal activities, 
performed by both service system entities separately. However, if these follow-up 
activities are a part of the agreed upon service proposal, e.g., the installation of an 
elevator with a maintenance contract for the next 5 years, they should be looked at as 
a part of the service realization activity. 

The service realization is not successful if one of the service system entities is not 
satisfied with the outcome of the service realization. This entity may decide to dispute 
the service outcome. If the service outcome is not disputed, the outcome of the service 
process is ‘service not successfully ended’. However, if one of the service system 
entities decides to dispute the service outcome, the nature of the interaction changes. 
All previous interactions are value proposition based interactions, i.e., based on the 
value proposition to which both customer and provider agreed. Here, we see a shift 
towards governance mechanism based interaction. 
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Service not 
successfully 



Fig. 5. EPC representation of service process model 

In case of dispute between two entities, the interaction will probably be regulated 
by a governing body like a mediation service or a court case. If the service system 
entities do not succeed in resolving the dispute, the outcome is still ‘service not 
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successfully ended’. Resolving the dispute provides a return path to the ‘realize 
service’ activity. However, a solved dispute doesn’t always mean that the service can 
be ended successfully. If a judge decides that an amount of money due by the 
customer is remitted, the dispute is solved but from the perspective of the provider 
this doesn’t mean that the service can be ended successfully. To have a successful 
service ending, all stakeholders should be satisfied with the service outcome. 

6 Demonstration of Service Process Model 

To evaluate the service process model, we demonstrate three service examples which 
strongly differ from each other [16]. The advantage of this approach is that each 
example can be seen as the representation of a category of services that can be 
modeled in a very similar way. 

The first example, a business lunch, is a type of service in which the exchange of 
physical resources forms an essential part of the service process. Figure 6 shows the 
EPC of a business lunch. The EPC shows that the service is not successfully ended as 
the customer didn’t receive the meal he ordered. After a complaint of the customer 
with the restaurant owner, it is decided that the customer doesn’t have to pay the meal 
and the dispute is settled. In the ISPAR model this would equal service outcome K. 
However, compared with the ISPAR model, the example shows a few improvements. 
First, as can be seen from the EPC, the realize activity has been divided into the actual 
realization of the service content, i.e., the cooking of the meal and serving it to the 
customer and the activity that initiates this service realization, i.e., the communication 
of the order of the customer to the cook. Therefore the EPC gives a more complete 
overview of the service process compared to the ISPAR model. Due to this division, it 
becomes easier for the provider, i.e., the restaurant owner, to determine the cause of 
the unsuccessful service delivery. Second, the model shows an unconventional 
proposal activity. The customer reads a lunch offer of a restaurant in a magazine. The 
advertisement states that a reservation is not needed. The example clearly illustrates a 
push scenario in which the customer initiates the service process. Although this kind 
of service proposal is not included in the ISPAR model, the advertisement can be 
categorized as a service proposal from the provider to the customer. Third, due to the 
EPC representation form, activities are clearly separated from outcomes. Each activity 
is followed by a certain state which determines the outcome of the service process. 

The second example shows a money investment service. In this case there is no 
physical exchange. The service is limited to a more abstract form of value co-creation. 
A bank notices a large amount of money on a customer’s account and proposes the 
customer to invest the money. The different investment possibilities are discussed 
during an appointment but an agreement is not reached. The customer then decides to 
make a second appointment, but again no agreement is reached and the service 
process is aborted. Figure 7 shows the EPC model. This example also demonstrates 
how the use of EPC enables a distinction between outcomes and activities. Moreover, 
other than the ISPAR model, our model allows a customer or provider to restore the 
service process after a failed agreement activity. The customer is not satisfied with the 
proposed investment rates and thus an agreement is not reached. The EPC provides a 
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return path through which the customer can reiterate the agreement activity. When 
modeling this example with the ISPAR model, no loops can be introduced, so the 
model needs to be instantiated again (i.e., it seems that a new service process is 
started) to show the second attempt at reaching an agreement. 




successfully 

ended 



Fig. 6. EPC of business lunch 




Fig. 7. EPC of a money investment service 



The third example, an online newspaper service, doesn’t include a physical 
exchange either. Moreover, there is no direct physical contact between the customer 
and the provider. Figure 8 shows the EPC which represents the category of online 
services. In this particular example the service outcome is mutual value co-creation 
(R), i.e., the service process is successfully ended for both the customer as the 
provider. However, as the proposal was not immediately understood by the customer, 
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a return path had to be used. After calling to the customer service, the customer 
decides to revise the service proposal. After a second reading, the customer is willing 
to agree to this proposal. By analyzing the model the newspaper company could come 
to the conclusion that the terms of subscription are not clear enough. Based on this 
observation the newspaper could decide to improve the subscription terms or, to 
invest in an extra telephone operator to answer questions of customers. Just as in the 
first example, the new division of the realization activities becomes clear. Before the 
actual service realization, an initiation signal is needed. In this case this is a 
confirmation email from the provider stating that the customer has access to the 
online articles. The ISPAR model doesn’t include an initiation signal and is as a 
consequence less complete. The downloading and reading of the articles represents 
the actual service realization. When the contract expires, the newspaper performs 
some follow up activities such as propose the customer to extend his subscription. 




Fig. 8. EPC of an online newspaper service 



7 Conclusion and Future Work 

In this paper we investigated whether the ISPAR model could serve as a good service 
process model. Our research points out four shortcomings of the ISPAR model from 
which we conclude that the model in itself is not sufficient as a process model and 
needs elaboration with several elements, some of them handed by other service 
process frameworks. The new service process model includes all important elements 
of is the ISPAR model while adding elements of two alternative frameworks. 

Future research may develop in two directions. First, the model should be 
elaborated such that an initiation signal can be given and received more than once. In 
the proposed service process model we assumed that this initiation signal had to be 
given only once. However, in some service situations such as a maintenance contract, 
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the service realization might be caused by a long iteration of initiation signals. This is 
not incorporated in the current model and could be an interesting point of elaboration. 
Second, in order to fully realize the goal of integrating a normative service process 
model into the service systems worldview, a mapping of the service process model 
onto the ten foundational concepts defined by the service systems worldview is 
needed. It seems only logical that the description of how a service system is structured 
and the description of how a service system behaves are linked together in one 
conceptual model of service systems. 
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Abstract. We are living in a world of interactions, surrounded by elec- 
tronic devices which are getting numerous and are complicating interac- 
tions. Moreover, the users are now mobile, evolving in multiple 
changing environments. The problem is even more complex when it 
comes to collaborative tasks where these conditions can inhibit produc- 
tivity and software as a service adoption. This paper presents an ongoing 
work on the usage of adaptive interfaces to address this problem and the 
issues raised. 

Keywords: Human-Computer Interaction, Collaboration, Software as 
a Service, Context-Awareness, Adaptive Interfaces, Group-Awareness, 
Model-Driven Engineering. 



1 Introduction 

Nowadays, we are living in a world of interactions. We are surrounded by elec- 
tronic devices which follow and assist us in our activities. This environment 
implies a diversity of Human- Computer Interactions (HCIs) which will be used 
in a broad range of contexts of use. These contexts are also evolving over time, 
adding another level of interaction complexity. This complicates users’ inter- 
actions but also conceptors’ work to build usable HCIs, hence limitations in 
proposing Software as a Service. This observation has led to new paradigm of 
interaction such as pervasive computing Ij and other theories like the situated 
action j2J, both of which are considering the context of use. 

The domain of adaptive interfaces follows these researches. Adaptive inter- 
faces are able to react to the changes within a context of use by adjusting their 
presentation and/or proposing different services. The aim of an adaptive inter- 
face is to preserve the usability of the interface across different contexts of use. 
When it comes to collaboration, the context of use is more complex due to the 
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fact that organisations are dynamic and flexible. While collaborative work could 
benefit from being based on adaptive interfaces, the latter still have to cope with 
the former. 

The purpose of the work related to this article is to promote the conception 
and the production of adaptive interfaces for collaborative environments. As a 
first part, this article presents the context of use concept and reports the cur- 
rent issues raised by in-context collaboration. The second part presents adaptive 
interfaces and more particularly the plasticity. The third covers the essential 
elements required by the plasticity to properly support the collaboration. Fi- 
nally, we present a work in progress by enhancing an existing adaptive interface 
framework to implement collaboration. 



2 Collaboration in Its Context 

In the today collaborative context, users have to interact in multiple situations. 
These situations represent different sets of conditions (e.g. different hardware, 
physical environments, collaborators. . . ). This complexify the design process of 
user interface and tends to limit the adoption of Software as a Service for col- 
laborative tasks. 

This section presents the notion of context and its impact on the conception 
of collaborative interfaces. 

2.1 What Is the Context of Use? 

Context of Use. In computer sciences, the most admitted definition of the 
context of use is given by Dey & Abowd 0 : 

“Context is any information that can be used to characterize the situa- 
tion of an entity. An entity is a person, place, or object that is considered 
relevant to the interaction between a user and an application, including 
the user and applications themselves.” 

The context is commonly split into three components: the physical environ- 
ment (i.e. weather, luminosity. . . ), the computing environment (i.e. the technical 
characteristics of the device hosting the application) and the user (i.e. his/her 
identity, preferences, skills. . . ). 

Highly Collaborative Context. A collaborative context is more specific than 
the typical three-component context of use. This is due to organisations and 
their particularities. As stated by Mintzberg gj, organisations can be dynamic 
and flexible: actors are from all walks of life, have different tasks, have differ- 
ent job positions and their hierarchy can wield different aspects according to 
projects’ conditions. In this respect, we will refer to this as a highly collaborative 
context. 
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2.2 Issues Related to Conventional Approaches 

Collaborative interfaces are commonly designed as monolithic blocks that sup- 
port only one specific context: the one it has been designed for. This approach 
is restrictive and may lead to issues related to communication, document man- 
agement and the consideration of the organisation topology jSj ■ Hence, it is sug- 
gested that interfaces supporting collaborative work should be able to adapt to 
the dynamicity of an organisation and the associated activities Adapting 

to a highly collaborative context is hinted to promote a better communication 
and coordination, thus enhancing the efficiency of the collaboration (but not 
necessarily the productivity). 

As an example, the Architecture, Engineering & Construction (AEC) sector 
is a good representative of a highly collaborative context. Many different jobs 
are involved with a broad range of skills. Depending on a project phase, the 
actors are not the same or does not have the same role (e.g. conception phase, 
construction phase, building life cycle. . .). A construction site can be a harsh 
environment (e.g. noise, dust, weather. . . ) and these conditions has a direct 
impact on the activities (e.g. depending on the regulation, workers may not 
be allowed to work under a given temperature) and on the use of electronic 
devices (e.g. too much light, not enough space...). Actors are mobile, like an 
architect who may work on different building sites, in an office or in site sheds. 
This makes the design of services difficult and misconceptions can lead to costly 
coordination and communication errors j5j. In AEC, services are tending to be 
integrated by monolithic software, sometime in an ad-hoc manner for specific 
projects. Researches in this sector are actively focused on service integration. 
As Shen proposed jS] , using software capable to adapt themselves to this highly 
collaborative context would improve communication and coordination reliability, 
and help to conceive better and more generic services. 



3 Adapting to the Context of Use 

To overcome the issues of highly collaborative context, we suggest the use of 
interface adaptation, a type of user interfaces taking advantage of the context of 
use. This section briefly present the starting point of adaptation to the context 
and is then focused on the principle of interface adaptation. 

3.1 Context- Awareness 

While defining its idea of pervasive computing, Weiser [Jj suggested that - for 
the user to be able to interact in a world of electronic devices — the HCIs have 
to be so intuitive to use that the user doesn’t notice he is interacting. To achieve 
this vision, the interfaces have to be intelligent and be able to know about the 
user and its environment. Therefore, such information systems are said to be 
context- aware. 
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The Context- Awareness. The context of use can represent valuable informa- 
tion regarding an interaction, allowing an information system to propose more 
relevant services (e.g. notifying the user of a shop proximity based on the user’s 
location and preferences). Such a capability is called context-awareness and has 
been introduced by Dey & Abowd 0 as follows: 

“A system is context-aware if it uses context to provide relevant informa- 
tion and/or services to the user, where relevancy depends on the user’s 
task.” 



3.2 Interface Adaptation 

Interface adaptation is a subsequent domain of the context-awareness. It pro- 
motes interfaces capable to adjust their presentation, the data or the compo- 
nents in order to better withstand changes in the context. Several definitions of 
interface adaptation exist depending on the problem approach. If Stephanidis et 
al. [7j refer to the adaptivity , Thevenin & Coutaz jSj refer to the plasticity of 
user interfaces. Our work is focused on the latter. Plasticity is a Model-Driven 
Engineering (MDE) top-down approach centred on the tasks. We think that this 
approach suits well collaborative work by being task-centric. Moreover, MDE 
conveys interesting principles regarding interface conception and service science 
over other approaches. Models are a formalism intended to be readable by non- 
initiated |9j, hence enabling the possibility to involve multi-disciplinary experts 
in the engineering process (e.g. designers, engineers, usability experts. . . ). There 
are also extensible and reusable. 

Plasticity models are composed of multiple levels of interface abstraction 10 
(see Fig. HI). The highest level of abstraction consists in the modelling of the 
task and the domain (i.e. the manipulated concepts, like dates, text fields. . .). 
Then, this model is reified through model transformations into a lower level 
of abstraction called abstract user interface (AUI). AUIs are interface models 
abstracted from any interactor (i.e. buttons, text boxes. . . ) and can by simplified 
as the general interaction flow. The next level of abstraction is the concrete 
user interface (CUI) which instantiates the interactors. It represents a complete 
interface but is independent from the computing platform. The actual execution 
of the interface is represented by the lowest level of abstraction, the final user 
interface (FUI). The particularity of plasticity is that it supports the context of 
use as Dey & Abowd |3j defined it with models for the user, the computing and 
the physical environment. These models impact the transformations to generate 
adapted interfaces. Plasticity also manages translations between contexts of use. 

Plasticity is an a priori method regarding the contexts. The different con- 
texts have to be known at the design time in order to be modelled. Therefore, 
the contexts are not discovered at runtime, limiting the scope of the adapta- 
tion. But this limitation has advantages: a fine-grained and a well controlled 
adaptation. It also takes advantage of users involvement in the definition of the 
required contexts of use. Hence, the quality of the final product will be near 
users’ expectations. 
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Fig. 1. The CAMELEON framewok {711)1 1 

The researches on plasticity resulted in the CAMELEON framework m3 and 
the model description language UsiXML EH which support the models pre- 
sented on Fig. Q Several other framework based on a similar concept exist, like 
TERESA H3, UseML [Ej, MANTRA (H or Malai [EJ. 



4 Adapting to the Collaboration 

As we mentioned, proposing adaptive interfaces for collaborative contexts is ex- 
pected to promote better usability, coordination and communication. Moreover, 
using plasticity — a MDE approach - allows to involve users and a broad set 
of experts during the conception phase. However, the current plasticity frame- 
works are not oriented toward practical collaboration. Some frameworks, like 
UsiXML EH do have a support for collaboration at a theoretical level but lacks 
of practical elements. More precisely, UsiXML highest level models (i.e. tasks 
& domain) are partly compatible with some collaboration theories but these el- 
ements does not translate well into AUI & CUI. The generated interface only 
consider the active user in its current task, having a focus on individual tasks 
and not on the collaborative activity. Hence, it does not take advantage of the 
theoretical modelling to promote a good coordination and communication. 

The objective of our work is to bring practical collaboration support to adap- 
tive interfaces. Plasticity being a top-down design, a framework has to comply 
with two aspects of collaboration (1) a theoretical support at the highest ab- 
straction level; and (2) a practical support at the most specified level. To this 
purpose, we reviewed both aspects to extend the plasticity. 

1 Figure adapted from 

http: //www.w3 . org/2005/Incubator/model-based-ui/XGR-mbui 
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4.1 Theoretical Requirements to Collaboration 

Concerning the theoretical aspect, we reviewed the most important collaboration 
theories and how they are commonly modelled. The objective is to condense the 
most significant and essential concepts for a good theoretical coverage and to 
know how to model them. The coverage of these concepts are essential to the 
plasticity task & domain model because the subsequent practical support will 
rely on them. 

Through collaboration theories reviews made by Lonchamp j[TQ and De Farias 
et al. m we dug into the following theories: 

— The activity theory is a psychological theory aimed at representing the struc- 
ture of the human activity. It organizes itself around the concepts actors, 
communities, tasks, rules, and tools. Communities are groups of actors that 
execute tasks depending on community rules. The tasks are mediated by 
tools. 

— The coordination theory is an inter-disciplinary theory for the understanding 
and studying of coordination processes. It uses the concepts of resources, 
users, tasks, and coordination mechanisms (i.e. temporal restriction to the 
resources access). Users execute tasks and use different type of coordination 
mechanisms to access necessary resources (e.g. user A is waiting for user B 
to produce the resource, or user A and B can access simultaneously the same 
resource. . . ). 

— The action/interaction theory emphasises the concepts of interaction trajec- 
tories, actions, users, communities, and technologies. Interactions and their 
trajectories represent the consequential actions needed in the execution of 
a task. Therefore, trajectories are sequences of actions done by users. Com- 
munities are groups of users which use technologies (i.e. tools) to accomplish 
tasks. 

Numerous other theories exist but we focused on the most significant and suitable 
to MDE (theories based on cognitive science are interesting to consider during 
the conception but hardly modelisable) . Based on De Farias et al. works [IJ) , we 
isolated the following important concepts: 

— Activity , is the representation of the tasks, their decomposition and their 
dependency as a general workflow; 

— Actor , is the representation of individuals that coordinate or execute tasks; 

— Organisation , is the representation of the relationships between the actors 
(i.e. hierarchy) and the rules regulating these relationships; 

— Resource , is the representation of elements which are required in the execu- 
tion of a task (and can be the product of another task); 

— Tool, is the representation of what mediatize the execution of task and/or 
the coordination. 

We also note the recurring occurrence of the artefact concept which encompasses 
both tool and resource concepts. De Farias et al. El already identified most of 
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them, with the exception of the organisation that we consider to be as important 
as the other regarding highly collaborative contexts (the organisation is usualy 
included in the activity or actor concepts). The organisation has an important 
impact on the coordination process. 

The main concepts and their relationship identified, we looked at how they 
can be modelled. We based our models on De Farias et al. m works but also on 
AMENITIES fTRj . AMENITIES is a methodology for the conception of group- 
ware and uses models to be thoroughly applied. While the models of AMENI- 
TIES are based on collaboration theories and are quite exhaustive, the method- 
ology does not intend to use them during the production phase of a groupware 
(i.e. the models are independent). We think that this model could fit in a MDE 
process and have considered them to improve the current plasticity models. The 
detailed additions are covered in section 15.11 

4.2 Promoting Practical Collaboration through Group Awareness 

On the practical side of the collaboration and based on Lonchamp’s literature 
review cei, one methods emerged to us: the group awareness. This method is 
oriented toward the communication and the coordination through the use of the 
context (which was the closest method to our needs regarding the use of contexts 
in plasticity). 

The context is a concept that has been investigated in Computer Supported 
Collaborative Work (CSCW), following the situation awareness theory 0. The 
group awareness — introduced by Gutwin & Greenberg m — emerged as a 
consensus in promoting coordination and communication. Group awareness is 
“the understanding of the activities of others, which provides a context for your 
own activity” (e.g. knowing what collaborators are online, their current task, 
their availability. . . ). Enriching your own context with the context of your col- 
laborators helps to analyse a situation, to coordinate and to communicate. This 
method is based on feedback mechanisms which help to inform the user on 
how the others activity is interacting with its own. For example, in an activ- 
ity of document co-edition, one can see in real time if other users are editing 
the same document, what part of it and what modification they did (e.g. see 
Google™Document^) . Another common example would be to display to ac- 
tors connected to the application, their availability, their current task, their 
location. . . These informations greatly help coordinating since actors know who 
to contact, where and when. It also takes advantages of the hierarchy: you can 
know who is responsible of your current task and the available means to contact 
him/her. It has to be noted that the group awareness is a passive interaction 
(e.g. the user does not ask the interface to know who is editing a document, it 
is always shown by non- intrusive markers). The interface elements required to 
give group awareness will be referred as group awareness interactors along this 
paper. 
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5 Towards an Adaptation Framework Supporting 
Collaboration 

Our solution to adaptive interfaces for collaboration is to extend the plasticity 
concept with theoretical and practical elements. The contribution operates at 
two levels (1) adding theoretical support to the highest abstraction level of plas- 
ticity models (i.e. the task & domain models); and (2) adding practical support 
to the lowest abstraction level. The latter involves acting on the transformations 
between the different levels (i.e. task & domain to AUI and AUI to CUI). The 
main objective is to take advantage of (1) to properly generate the practical 
support. 

We based our approach on an existing adaptation framework. We went with 
UsiXML m which was the most documented and proven framework along with 
an active community and a standardisation in progress to the World Wide Web 
Consortium. 

5.1 Base Concepts Support 

Here we follow the investigation presented in section n~Tl to extend UsiXML task 

6 domain models with proper theoretical support. We previously highlighted the 
essential concepts to that support (i.e. activity, actors, organisation, resource & 
tool). To this purpose, we reviewed UsiXML models for each of these concepts 
and checked its expressiveness. UsiXML has to be able to correctly model the 
concepts and their relationships. Table [3 summarises UsiXML coverage of the 
needed concepts regarding our expectations and Figure El presents our extension 
to UsiXML. 

Concerning the expressiveness of UsiXML, we expect the activity to be rep- 
resentable by tasks (decomposed in elementary task items) and by a general 
workflow (defining tasks temporal dependency). In a flexible organisation, tasks 
may also not be governed by a process since independent and punctual tasks may 
occur. UsiXML provides a complex task model (based on a task tree formalism) 
and a process model which comply to the workflow notion. However, these mod- 
els limit UsiXML to processes and don’t cover the need of independent tasks. 
To this purpose, we added a relation between the workflow and task models to 
reflect to possibility to model independent tasks. 

Resources are well represented and allow to model different types of resource 
(e.g. material resources like a computer, immaterial ones such as a service or an 
actor) but lack of a relationship between them — resources may be composed 
of other resources or be related to another. 

Tool is meant to be the definition of the user interface and to this purpose 
UsiXML propose a CUI model comparable to what one can express with common 
programming languages. Hence its coverage is fairly exhaustive. 

Regarding the organisation concepts, UsiXML lacked the ability to define 
complex organisations with a flexible hierarchy and the possibility to define the 
rules commanding the interaction between the actors within the hierarchy. In 
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Table 1 . UsiXML coverage of collaboration theories (based on UsiXML 1.8) 



Concept Expected expressiveness UsiXML coverage 



Activity 



Actor 



Organisation 



Resource 



Tool 



Individual tasks and their 
temporal dependencies 
(to form a global activity) 
Users’ profile 

(i.e. identity, role, skills, par- 
ticularities. . . ) 



All types of hierarchy as ex- 
pressed in collaboration the- 
ories 

Description, availability and 
traceability of resources and 
also the links between them 



Description of the user inter- 
face 



Limited, the process & task models 
allow process modelling but don’t 
support punctual tasks 
Limited, the userStereotype model 
only offers stereotypical attributes 
like the skills, and the job model 
encompasses the role but there is a 
lack of real user identification and 
no clear link between job and user- 
Stereotype 

Limited, supports actor’s attribu- 
tion to an organisation but no hi- 
erarchy is implied 
Limited, the taskResource model 
represents fairly well all different 
types of resources but lack of re- 
sources relationship (e.g. composi- 
tion, association. . . ) 

Yes, via the cuiModel 



this respect, UsiXML is already semi-compliant with the activity theory through 
the possibility to form groups of actors in an organisation (i.e. the association 
between two organisation on the model, see Fig. EJ. We added its full compliance 
with the concept of relationship between actors and organisations, a relationship 
being defined by a commanding rule to properly express the hierarchical rules 
(e.g. contractor, departments. . . ). These rules are also dependent on the tasks 
to reflect flexible organisations in which actors micro-organisation may depends 
on the task to accomplish. Our models are inspired by a model representation 
of the activity theory [TJ) and by AMENITIES JIB], making UsiXML compliant 
with the activity theory but also with theories presented in section ITT! 

Regarding the actor concept, we added the identification of an actor through 
an extension of the userStereotype model. In UsiXML, users are not directly 
identifiable, this identification is meant to be done at application runtime and 
independently of the models. Regarding collaboration and the requirements for 
group awareness, we needed to be able to identify users at the models level be- 
cause the subsequent group awareness interactors may need to know the users 
involved. Our extension is meant to fill this gap with clear users identification 
since the userStereotype model — as it is named — is meant to represent stereo- 
typical groups of user having the same skills and affinity with technology. We 
based our extension on the General User Model Ontology (GUMO) [2D] which 
is a very exhaustive model including user identification along with user’s roles, 
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abilities and numerous other personality traits. We also added an actor-to-actor 
relation associated to rules ( userRelationship ) in order to express clearer hierar- 
chy with rules like supervision or advising. 

While extending UsiXML, we tried to stay true to the original definition. Our 
extension does not interact with it and should remain compatible. 
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Fig. 2. UsiXML task model extension proposal for collaboration support presented in 
UML 

5.2 Group Awareness and Transformations 

Once the adaptation framework has a coverage of the mandatory theory support, 
the top-down approach exposed on Fig. Q has to properly generate the practical 
aspect of collaboration. In our case, we are looking into transforming the highest 
concepts into user interfaces with group awareness features (see section [PI This 
part of our proposal is still on an early stage and represents the biggest challenge, 
therefore we are only presenting the general direction of our work. 

Regarding UsiXML, the transformation part of the interface generation pro- 
cess is achieved through a graphs transformation mechanism El (AGG for in- 
stanc^). The main steps are the reification of the task & domain model into 
the AUI model, and the reification of the AUI model into the CUI one. For the 
first step, Penichet m introduced a new element in the AUI model, an abstract 

3 Attributed Graph Grammar: http://user.cs.tu-berlin.de/~gragra/agg/ 
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awareness container , intended to host interactors providing group awareness. As 
of the transformation itself, the problem is centred on identifying the conditions 
that will produce abstract awareness containers (e.g. a task involving more than 
one actor may benefits from a display of the list of online collaborators). To 
this purpose, we can find inspiration in the groupware conception methodology 
AMENITIES P3 (that inspired Penichet’s work). The second step, the trans- 
formation of AUI into CUI, involves the instantiation of the abstract awareness 
containers into actual group awareness interactors. The problematic is the same 
as in the first step, identifying the type of interactor needed depending on the 
collaboration settings. This step will rely on a finite set of group awareness in- 
teractors. Such a set can be derived from Gutwin & Greenberg works nn. a 
side step, important for the plasticity, is the translation between contexts. This 
step is done through the transformation of a model into another model of the 
same level of abstraction (i.e. AUI to AUI, CUI to CUI...). While this step 
can be done at any level of abstraction, we choose to concentrate on the task & 
domain translation which is the less complicated and still allows to regenerate 
all the lower models. We consider the other translation as shortcuts and we may 
address them in a future work. 

6 Closing Words 

6.1 Ongoing Work 

Our current effort is focused on model transformations (see section 1 , 6 . 21 ) . The 
main objective is to identify the conditions needed to generate group awareness 
interactors and to model the subsequent transformations. 

We are also working on a validation protocol for our research. Testing adaptive 
interfaces raises many issues for empirical tests (notably the criteria to observe 
while comparing adaptive and on-adaptive interface). Currently, we are tending 
toward qualitative testing of the design process in order to know whether our 
approach is valid against conventional methodologies. 

6.2 Perspectives 

The interest of this work is to propose a framework for the design of user in- 
terfaces in highly collaborative contexts. This framework is independent of any 
programming via MDE and allows to involve multiple disciplines and users in the 
conception process. A practical collaboration support of this framework could 
enhance communication and coordination, along with a better adoption of Soft- 
ware as a Service in environments within which service adoption is lower due to 
the context conditions. 

6.3 Conclusion 

Facing the ever growing complexity of interacting in multiple contexts of use, 
we propose the use of adaptive interfaces for collaboration for better Software 
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as a Service. Through the use of a Model-Driven Engineering process for inter- 
face adaptation — called plasticity — we are promoting a conception method 
for collaborative interfaces which is intended to be generic and suitable to the 
contexts variety. To this purpose, we presented an ongoing work on extending 
an adaptive interface framework — UsiXML — to better support collaboration. 
While our method and its results still have to be tested, we expect that such 
interfaces and conception process will enhance service quality and innovation in 
highly collaborative contexts. 
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Abstract. The prevalence of the service paradigm spans diverse do- 
mains like commercial, social, technological or scientific. Due to its sim- 
plicity and familiar semantics, it provides a powerful general abstraction 
for system programming, interaction, and integration. Several standard- 
isation efforts have further contributed to the popularity of the service 
concept and its usage, since this provides a uniform access to and aggre- 
gation of entities with different characteristics and at different levels of 
the cyberinfrastructure. The perceived current trend on making every- 
thing accessible as a service ( XaaS ) builds on such service characteris- 
tics, and examples range from Web-enabled Wireless Sensor Networks, 
the Internet of Things and Web of Things, to Cloud computing, and 
the Internet of Services. Upon the acknowledgement of such high het- 
erogeneity and of the extreme large scale of emerging service systems, 
Service Science presents a novel and overarching view on analysing and 
developing further the service paradigm. The high complexity of current 
and future service systems in this domain, require innovative solutions 
to be developed in order to improve service productivity and quality. To 
this extent, this work concentrates on service engineering Web services 
and proposes a solution based on the Session concept contributing to 
solve open problems on service system interaction and adaptation. The 
focus is on the interactions between Web services interfacing stateful re- 
sources and its clients, in particular. The session abstraction is used to: 
a) capture the service/users interaction context, b) support dynamic in- 
teraction models within, and c) contextualize on demand and automatic 
dynamic adaptations. The major goal is to capture Web service/users 
interactions modelled as Sessions, in order to simplify their re-use and 
adaptation in the context of the cited Services Sciences’ complex systems. 



1 Introduction 

Services Science P] aims to define and promote the systematic development and 
innovation in service systems, following an interdisciplinary perspective. The 
popularity of the service paradigm and its presence across the digital word, 
points to a novel services industry and economy incorporating concepts from 
very different areas. Management, social, legal and engineering aspects are taken 
into consideration on analysing and developing further the service paradigm, in 
order to improve service productivity and quality m 
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The emerging prevalence of the service concept arises somehow with no sur- 
prise. It has been present in digital systems since the beginning (e.g. in operating 
systems/Internet protocol stacks), and the concepts of service provision and us- 
age have been common sense in human societies. The service paradigm provides 
today a powerful general abstraction for system programming, integration and 
interaction, due to its simplicity and familiar semantics. Several standardisation 
efforts have further contributed to its acceptance on providing standard/uniform 
access and aggregation of entities with different characteristics and at different 
levels of the cyber-infrastructure jT • Building on the overall service characteris- 
tics, the current trend is making everything accessible as a service ( XaaS ), and 
a few examples are given bellow. These examples contribute somehow to the 
cited Services Science’s overarching view on analysing and developing further 
the service paradigm. Namely, 

— Web enabled Wireless Sensor Networks (WSNs) jbltij composed of either 
static or mobile devices, offer a high-level interface to low cost large-scale 
sensing of the environment, allowing WSNs inclusion in Web environments, 
e.g. in the context of business processes. Such allows WSNs uniform and sim- 
ple access, parametrization and aggregation, and systematic data collecting. 
WSNs are fundamental for current and future systems supporting complex 
applications development |2j to which the interaction with the real world 
is a pressing requirement. Such includes traditional scientific applications 
like meteorology prediction simulations, and novel applications like urban 
traffic management or virtual social communities’ support in the domain of 
Participatory Sensing jH|. WSNs are cited as crucial in the context of Ser- 
vices Sciences, in particular, for their relevance on the development of an 
intelligent environment. In the latter, online/real-time data is provided to 
service users, and conversely, service users may in turn parametrise those 
sensor systems. This subject- environment interaction model supports a co- 
production partnership between services and users and is fundamental for 
service systems’ adaptability m- 

— Internet of Things HQ] , in turn, uses services as the main abstraction for the 
simple integration of objects and entities, either real or virtual, within intel- 
ligent contexts. Those objects and entities can be accessed through services 
being thus the service concept the main abstraction for such integration. 
This allows, for instance, service development in the business area, provid- 
ing more diverse, highly dynamic, and efficient services, as described in the 
context of the Web of Things HU. 

— Cloud computing m aims at providing standard solutions for different types 
of service access (example of a contribution in this domain in [[13| ) . Current 
cloud platforms provide large-scale data and computational resources ( Data 
and Computational Clouds), and offer services at different levels, from the 
low level IaaS ( Infrastructure as a Service) to PaaS ( Platform as a Service), 
offering fundamental services for application development. For the Services 
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Science context and the Future Internet in particular, the authors in pnj 
highlight the relevance of cloud (and grid) services for service systems’ seal- 
ability. 

— Internet of Services aiming at using the Internet for service deployment 
and usage similarly to its support to the Web. In this case, services can be 
seen as negotiable entities, e.g. in the form of service ecosystems, and can 
be used to create value in the business area [E3 ■ 

Analysing the above examples, we defend that one useful common concept to be 
considered in these domains is the notion of Stateful Services. By this we mean 
services interfacing stateful resources or continued activities. These require the 
realization of a dynamic/variable state which has to be kept consistent along sev- 
eral message exchanges between a service and each one of its clients m . Examples 
of the utility of stateful services for the above domains are resource tuning based 
on users’ context or the history of previous parametrisations; predicting the status 
of running applications; or evaluating resource consumption and related cost at 
runtime. Additionally, and also as a consequence of clients accessing such stateful 
services, one pressing requirement is on systems’ dynamic adaptation. This is fun- 
damental to support service systems’ evolution in order to cope with novel user 
requirements or modifications in service systems themselves. 

The interactions to stateful Web services imply, consequently, more com- 
plex interaction models between a service and its users, besides the tradi- 
tional request/response access. Examples are event subscription and notification 
paradigms, or stream-based data dissemination. New models and solutions for 
stateful Web service interaction are hence required, including the support for 
dynamic adaptation mechanisms. These may comprehend, for instance, support 
for fault-tolerance concerns (e.g. related with service or interaction medium fail- 
ures), or allowing users to directly and dynamically control and modify such 
interactions (e.g. dynamic selection/replacement of the used interaction model 
with a service). 

The above limitations pertaining current Web services interfaces for state- 
ful services are described in the next section. The following section describes 
a proposed solution based on the Session and Pattern concepts capturing dy- 
namic interactions models for services/users interactions. The following sections 
describe the implementation architecture and an application scenario. The con- 
clusions are described in the final section, as well as future work. 

2 Problem Dimensions and Proposed Solution 

One of the strengths of the service paradigm is the simplicity of its basic in- 
teraction model, namely the request/reply interaction in its stateless mode, e.g. 
Web services in their primitive form. Several of such independent interactions 
occurring onward among a service and its users allow hence a true decoupling 
between requests and their service. 

However, the growing demand on interfacing stateful resources through ser- 
vices suggests the need and advantage on the existence of more complex and 
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flexible interaction models between service providers and their users. For in- 
stance, in the particular context of Web enabled WSNs 0: a) the Publish/- 
Subscriber model m supports user notification on previously subscribed WSN 
topics, e.g. when the average temperature value collected on a WSN has exceeded 
a pre-dehned limit, all subscribed users for this specific topic and condition are 
notified; b) the Streaming model |1 Hj supports data dissemination of sensor col- 
lected data in the network. 

Albeit new interaction models as the ones above have been made available 
for interfacing stateful Web services, such interactions are still limited and lack 
mechanisms for their dynamic adaptation. One example may be the need to 
dynamically aggregate diverse data streams (e.g. similarly to mashups) generated 
from different but related stateful Web services. For instance, in order to obtain 
more precise temperature values occurring in one particular geographic area, 
it may be necessary to dynamically gather data collected from several WSNs 
positioned at different heights from the ground; meanwhile, such data may also 
need to be complemented with humidity data collected from other WSNs also 
deployed on the same geographic area. Such dynamic aggregation of data streams 
may hence free consumer applications from having to explicitly access different 
Web services. Applications in the context of stateful Web services may therefore 
benefit from a richer and more flexible control on interfacing their associated 
services. To this extent, the following dimensions have to be considered: 

— The interaction’s context which includes: a) the context of the service user 
(e.g. a mobile device with limited autonomy or progressing to a different 
geographic area); b) the interaction medium between the service and its 
user (e.g. the characteristics of the supporting communication networks); 
c) the service’s context (e.g. the status of the executing application and/or 
resource availability on their execution support environments). 

— The interaction may evolve in time as a result of either an explicit user re- 
quest or automatically triggered by the runtime system upon context change 
detection. 

To deal with such problem types, in the following we describe a solution based 
on the concepts of Session and Design and Architectural Patterns piTHj . 



Pattern-Based Dynamic Reconfiguration. The proposed solution is based 
on the pattern concept and its usage is twofold: 1. To represent (common/novel) 
interaction models among clients and services as pattern abstractions in the 
form of Pattern Templates m ■ These are reusable first class entities, considered 
both in the dimensions of structure and behaviour, which can be acted upon 
(e.g. parameterisation and refinement). 2. The pattern abstractions support a 
structured dynamic adaptation mechanism which may be dependent on the state 
of interaction’s context above: a) the patterns are dynamically reconfigurable 
themselves; b) the adaptation/evolution of the system may be represented as a 
sequence of patterns, and this sequence is pre-defined and captured as a state 
machine, as will be detailed in Section 0 
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In this work, we use pattern-based abstractions in form of Structural and 
Behavioural Pattern Templates, as well as their composition, as defined in [20]. 
Structural Pattern Templates (SPT) define the semantics of the structural con- 
nections among the elements within the pattern. However, they do not specify 
any restrictions in terms of data or control flow dependencies. Those SPT include 
associations like topologies (e.g. Pipeline, Star, ring) as well as Design Patterns 
tm (e.g. Fagade, Proxy, etc.). The allowed structural reconfiguration is conform 
to the pattern semantics it is applied to (e.g. modification of the number of 
sub-systems within a Fagade, but the the central element providing a common 
interface to all sub-systems has to be always present within the SPT). 

Behavioural Pattern Templates (BPT) define the data and control dependencies 
among the elements within the pattern at runtime. Additionally, BPT annotations 
define the role of each element - e.g. in the Publish/Subscriber semantics there 
are the roles of the publisher and subscribers, but also the definition of data and 
control flows in the form of asynchronous notifications on the subscribers. Other 
patterns are Streaming, Producer/Consumer and Client/Server. Again, each one 
is reconfigurable according to its semantics which is kept consistent. For instance, 
it is possible to change the number of producers and/or consumers, but at least 
one producer has to exist always. Moreover, the separation of concerns in structure 
and behaviour allow the flexible composition of pattern templates and its dynamic 
reconfiguration (e..g a star with a Producer/Consumer pattern which is modified 
to a Publish/Subscriber pattern) |2Dj . 



Sessions Embodying Service/User Interactions. The Session concept is 
used in this work to capture the interaction context to a service interfacing 
stateful resources, a well as the dynamic reconfiguration features possible within 
that context. A session includes: 

— The identification of a particular service plus the particular interaction model 
in use at some point in time. All user accesses within the context of this 
session obey the semantics of that interaction model. The need to access the 
same service with two different interaction models, say Publish/Subscriber 
and Producer/Consumer, results on the existence of two distinct sessions. 

— The architecture of the particular interaction model in use representing run- 
time data and control flow dependencies between a service and its users. 
An interaction model is generally captured as a composition of a structural 
pattern (usually a Fagade or a Pipeline) with a behavioural pattern. 

— A unique session identifier used by new clients joining the session. 

— The identifiers of all of the session’s clients at some point in time. 

— The definition of a session’s life time, which upon expiring results on the 
destruction of the session and consequent notification of all its members; if 
this time is unbounded, a session is only destroyed by an explicit request. 

— The identifier of the session’s owner. The owner is allowed to end the session’s 
execution as well as to explicitly reconfigure the interaction model in use. 

— The possible context-dependent structured adaptations. 
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The implementation of the Session concept and possible dynamic reconfigura- 
tions within an underlying middleware are described in the next section. 

3 The Middleware Layer 

This section presents a middleware layer for the adaptable access to stateful 
resources. It resorts to the notion of Session to capture the interaction context 
to a service interfacing those resources, as described in Section El and enables 
the dynamic reconfigurations possible within that context. The latter include 
the tuning and the replacement of the current interaction model. 

We begin the middleware’s description with an overall overview of its archi- 
tecture, proceeding then to a more detailed explanation of its components. 



Presentation layer 



Logic layer 



Data layer 



( AP| D 



Session 




Structural 


\ 


Behavioural 


Manager 




Patterns 




Patterns 



Data Sources (Stateful Resources) 



Fig. 1 . The middleware’s overall architecture 



The middleware’s architecture (Figure EJ follows a three-tier model that 
cleanly separates presentation, logic, and data management. The presentation 
layer takes the form of a Java API that acts as an intermediate between the 
client application and the the Web accessible middleware layer. This API will 
be presented in Subsection 13.21 

The logic layer provides the runtime support for sessions, namely for the fea- 
tured interaction models and their dynamic reconfiguration. Besides the stan- 
dard Client/Server interaction model, the middleware currently supports the 
Publisher/Subscriber, Producer/Consumer, and Streaming models, which are 
captured as behavioural patterns. Moreover, it supports the Aggregation of any 
of the former, being that this interaction model is implemented as a combination 
of multiple structural and behavioural patterns. 

The data layer is responsible for accessing the data sources via Web service 
technology, and providing them to the upper layer. 

3.1 Implementation 

A Session is implemented as the combination of the Fagade structural pattern 
with a behavioural pattern (the interaction model), and is associated to one or 
more topics that identify its data sources (Figure 0). The Fagade captures the 
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relationships between the members of the session: middleware and clients, and 
provides the means for the former to disseminate data to the latter, according 
to the established interaction model. 



Session 

-Sessionld 

-Owner 

-Users 

-Related Topics 
-Session lifetime 






Structural Pattern 


- 


Behavioural 

Pattern 



0 0 0 
User User User 



Fig. 2. Session implementation 



Sessions are managed by the Session Manager (the main component of the 
system) that is responsible for maintaining their consistency and their link to the 
requested data sources (services). Furthermore it validates every client request, 
ensuring that it is applicable in the context of the current interaction model, 
and provides for the supported dynamic reconfiguration mechanisms. Note that 
reconfiguration requests can be explicitly issued by clients (on-demand reconfig- 
urations) and automatically generated by the Session Manager, as a response to 
an alteration on the overall context of the session, e.g. a data source is no longer 
reachable. More detail on the reconfiguration mechanisms will be given ahead. 

As mentioned before, the supported interaction models are instantiated as 
behavioural patterns. The sole exception is the Aggregation model, which is im- 
plemented as a Pipeline of two Fagades (Figure E|). The first has the purpose of 
aggregating multiple data sources, being that the aggregating logic (the Aggrega- 
tion Function ) is parametrizable and, thus, supplied by the client when issuing 
the request for the structure to be created. The second is the dissemination 
fagade present in every session. 



Dynamic Reconfiguration. The state machine that specifies the transitions 
between the interaction models bound to a session is depicted in Figure El For 
the sake of simplicity, the machine was divided into four: state machines Eil El 
and E3I depict the reconfiguration requests explicitly issued by a client, whilst 
state machine EEI reports to reconfiguration requests automatically triggered by 
the middleware to respond to specific changes in the session’s context. 

The first state machine (Figure ITal) refers to requests to replace the current 
interaction model. It is possible to reconfigure from any model to another. If the 
reconfiguration request is issued by the owner of the session, the whole session 
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Fig. 3. Implementation of the Aggregation interaction model 

is reconfigured and its clients are notified. Otherwise, if the request is issued by 
some other client, it is the client that is reconfigured to another session with the 
required characteristics. If no such session exists, it is created on the fly. 

The second state machine (Figure El identifies the reconfigurations that are 
triggered by the middleware, as a response to the changes in the context of the 
session, client, or the communication between them. A session becomes invalid 
if the owner of the session leaves it, the lifetime of the session expires, or its 
data sources (monitored resources) become out of reach. In the scope of the 
Stream and Producer/Consumer interaction models, if the data flow is suddenly 
interrupted, the middleware checks if its source it still reachable, and if so, 
reconfigures the session to Publish/Subscribe bound to the same topic. The 
clients are notified as soon as the data flow resumes. In turn, the Lower the 
rate transition occurs only in the scope of the Producer/Consumer model. It is 
triggered whenever the middleware detects that the client side is no longer able 
to consume the data at the rate that it is sent. 

The third state machine (Figure El is related to the Aggregation interaction 
model. Any interaction model can be replaced by an Aggregation, and new data 
sources can be added to an existing aggregation (the addlnteraction transition). 
If the session becomes invalid, the session is automatically reconfigured to the 
basic Client/Server model. 

Finally, the fourth state machine (Figure eh specifies the automatic recon- 
figurations related to the Publish/Subscribe interaction model. When a client 
associates the Publish/Subscribe model to a session, the middleware allows it 
to indicate an extra interaction model to which it is automatically reconfigured 
when a notification on the subscribed topic is received. 

3.2 The Application Programming Interface 

The middleware’s interface must allow applications to create sessions, to bound 
them to a particular interaction model, to join currently active sessions, to 
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Fig. 4. Reconfiguration State machine 



associate actions to incoming data, to perform on-demand reconfigurations, and 
to adapt to reconfigurations performed by the owner of the session. This subsec- 
tion addresses these dimensions. 

Creating Sessions: A session is represented by the ClientSession class, whose in- 
stances can be parametrized with the session’s duration in minutes (unbound 
is the default), and an interaction model in the form of a behavioural pattern. 
If no model is supplied, the session will only have the ability to perform syn- 
chronous queries following the Client/Server model. For that purpose, the class 
provides the query method. Figure 0 depicts a simplified version of the API’s 
class diagram. 

All interaction models share a common interface (I Pattern) but feature specific 
constructors and set of operations. Common to all constructors is the topic (or 
set of topics) that determine the data source, and a listener that is responsible for 
handling all the data emitted in the scope of the present session. This includes ac- 
tual application data, reconfiguration notifications, and error notifications (more 
on this ahead). Coming to specifics, the Stream and Producer/Consumer classes 
require the definition of the data transfer rate; the Publish/Subscribe class allows 
for the configuration of the interaction model to which the client automatically 
reconfigures when a notification on the subscribed topic is received; and the 
Aggregation class requires the name of the class that provides the aggregation 
function, and which is the actual dissemination model. The aggregation func- 
tion must be a subtype of class AbstractAggregation Function, extended with the 
the implementation of the aggregating logic. This logic must consume multiple 
sources and produces the data items to be disseminated to the clients. 
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Fig. 5. Class diagram of the API 

Joining Existing Sessions: The ability to join existing sessions is provided by 
the join method. It requires the identifier of the session to join and the listener 
to handle incoming data. The inquiry of which sessions and topics are currently 
active is possible through methods requestAvailableSessions() and getAvailable- 
TopicsQ, respectively. 



On-demand, Reconfiguration: On-demand reconfigurations are twofold: the ones 
that are performed over the current interaction model, and the ones that replace 
the current interaction model by another. The first is achieved through the recon- 
figureCurrentPattern method, which allows the application to invoke an operation 
valid in the scope of the current interaction model. For instance, change the data 
transfer rate when in the scope of a Stream or a Producer/Consumer, or change 
the aggregation function when in scope of an Aggregation. The invocation of 
an operation not valid in the current scope raises an exception. The second is 
provided by the reconfigure method that receives the interaction model to which 
the client wants to reconfigure to ( Subsection 13.11) . 

Handling Incoming Data and Notifications: In order to handle the data sent by 
the middleware, the client must provide a notification listener. This listener is a 
subtype of abstract class AbstractClientNotificationListener that must implement 
the following methods: 

— processMessage - to handle application data; 

— invalidSessionNotification - to handle the notification that the session has 
become invalid; 

— noDataNotification - to handle the notification that there is no data available; 

— sameFlowNotification - to handle the notification that the session has been 
reconfigured but the topic remains the same; 

— diffFlowNotification - to handle the notification that the session has been 
reconfigured and the topic has changed; 
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— pubSubNotification - to handle the notification that the session has been 
automatically reconfigured to the reconfiguration pattern associated to pub- 
lish/subscribe behaviour; 

— ownerAdd Interaction Notification - to handle the notification that the session 
has been reconfigured because a new data source was added. 

To operate over the session to which is bound, the listener can obtain a reference 
to the former by invoking the getSession() method. 

A Simple Example: Listing 11.11 showcases a small example in the context of a 
set of sensor networks that monitor temperature and humidity. The goal is to 
create a session (st) bound to a Publish/Subscribe interaction model that notifies 
the client once the temperature rises over 5°C (lines 5 to 7). Associated to this 
notification is an automatic reconfiguration that alters the session’s interaction 
model to an aggregation of the previously monitored sensor network with a 
new temperature network (Temperature2) placed at a different height, and an 
humidity sensor network (lines 2 to 4). 

The aggregation function of line 1 is defined in Listing 11 .21 The method to 
be implemented returns an instance of class Notification Message, which denotes 
a data packet to be delivered to the clients in the session. The consuming of the 
data sources resorts to method getNextDataltem(). 

Listing 1.1. Creation of a session 



1 M y Aggregation F u n ct ion aggregate = new M y Aggregation F u n ct ion () ; 

2 Aggregation critical = new Aggregation( 

3 { ’’Temperature”, "Temperature2", "Humidity”}, 

4 aggregate, Pattern .STREAM, 4, new Listener2()); 

5 PubSub normal = new PubSub(" Temperature > 5" , new Listenerl () , critical ); 

6 C I i e n t S e ss i o n st = new C I i e n t S ess i o n ( norma I ) ; 

7 st . st a rt ( ) ; 



Listing 1.2. Defining an Aggregation Function 



1 

2 

3 

4 

5 

6 

7 

8 
9 

10 



public class MyAggregationFunction extends 
AbstractAggregation Fu nction { 

public N ot i f i ca t i o n M essa ge apply(){ 

N ot i f i ca t i o n M essa ge msg = new N ot if i ca t i o n M essa ge ( ) 
msg. add ( getNextDataltem (” Temperature" ) ) ; 
msg. add ( getNextDataltem (" Temperature2 ” ) ) ; 
msg.add(getNextDataltem(” Humidity” )); 
return msg; 

} 

} 



To illustrate the definition of a listener, Listing [Ql sketches the implementation 
of two methods of Listened. Consider that the listener has access to a graphical 
interface (GUI) by the means of the gui variable. Whenever application data is 
received it is forwarded to this GUI (lines 2 to 4). If a notification indicating 
that no data is available, a notification is sent to the GUI and the session is 
reconfigured to wait for a notification that new data has been published in any 
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of the topics. For that purpose, it resorts to an aggregation parametrized with 
the any aggregation function (lines 5 to 9). 

Listing 1.3. Sketching the Implementation of a Listener 



1 


public class Listener2 extends A bst r a ct C 1 i e n t N ot i f i ca t io n L iste n e r { 


2 


public void process M essa ge ( C 1 i e n t N ot i fi c a t i o n M sg msg) { 


3 


gui . display( msg . getContents ( ) ) ; 


4 


} 


5 


public void NoData Notification ( NoDataException e) { 


6 


gu i . d i s p 1 a y N o t i f i c a t i o n ( " Lost connection to data sources”), 


7 


getSession (). reconfigu re (new Aggregation ( 


8 


{ Temperature” , "Temperature2", "Humidity"}, any, Pattern. PUBSUB , this ) ; 


9 


} 


10 




11 


} 



4 Related Work 

The work in m presents one solution for self-adaptability of service-generated 
data streams targeting problems such as data loss or delays associated with 
communication networks disruptions. The solution uses a distributed hierarchi- 
cal structure of controllers /actuators for a) adjusting data flow according to the 
detected dynamic variations; b) saving these data in buffers whenever neces- 
sary in order to avoid data loss; c) in-transit data processing at the hierarchy 
nodes hence reducing the execution time of the application generating the data. 
Nevertheless, interaction models are not present in the above work as explicit 
configuration options considering service interactions as presented in our pro- 
posal. Although the cited aproach does implement a (sophisticated) Producer/- 
Consumer interaction model, such is restricted to the support system (i.e. it is 
not explictely visible at the point-to-point interaction level between a service 
and its user). Furthermore, in EH there is no reference on the possibility to 
dynamically add new data flow consumers. This is possible in our approach by 
adding new clients to the proper session. Moreover, and in the context of this 
same session, it is possible to dynamically acquire data from additional data 
flows supported as an automatic or requested reconfiguration to an aggregation 
interaction model. Finally, our solution includes a set of richer interaction mod- 
els like the cited possibility of parameterising a Publish/Subscriber session with 
a new interaction model. The session’s dynamic reconfiguration to the latter can 
be automatically enforced as a consequence of a particular notification of the 
subscribers. 

Some other works also use the pattern concept for systems’ self-adaptation 
mechanisms but in a different way than our solution, namely, by making use 
of reconfigurable Architectural Patterns on system definition 1221 For example, 
the inherent architecture of the Publish/Subscriber pattern allows it to be re- 
configurable in terms of the number of publishers, subscribers, and the events 
they subscribe to; the Master/Slave pattern allows the addition of new slaves to 
optimise task execution m- Such is also incorporated in our solution within the 
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context of a session. In spite of that reconfigurable system architecture definition 
by the cited works, these do not support the notion of a session capturing an 
interaction’s context, nor the system’s evolution as a sequence of patterns. In our 
proposal, this sequence is ruled by well-defined transitions which are conform to 
each pattern’s semantics and provide forms of system’s consistency guarantees. 
Such per-pattern reconfiguration contributes to limiting, to some extent, the 
impact of the system’s dynamic reconfiguration. 

Finally, our solution is based on the work by |2( )| which, however, does not 
target the stateful services’ domain nor provides a session context. Additionally, 
it also does not implement systems’ evolution conforming to a state machine 
dependent on interaction’s context between a service and its users. 

5 Conclusions and Future Work 

The high relevance of the service paradigm is already evident across different 
domains may these be commercial, social, technological or scientific. Due to its 
simplicity and familiar semantics, it provides a powerful general abstraction for 
system programming, interaction, and integration. Such is perceivable on the 
current trend of making everything accessible as a service ( XaaS ). 

Upon the acknowledgement of the high heterogeneity and extreme large scale 
of current and future service systems, Services Science 0 presents a novel and 
inter-disciplinary view on analysing and developing further the service paradigm. 
The high complexity of service systems in this domain, require innovative solu- 
tions to be developed in order to improve service productivity and quality, and 
for which scalability, and hence dynamic adaptability, are pressing concerns. 

To this extent, this work focuses on providing richer and dynamic interac- 
tion models to stateful Web services. The proposed solution is based on the 
concept of Design Patterns to build a middleware supporting such interactions. 
These include data access via Behavioural Patterns like Producer/Consumer, 
Streaming, Publish/Subscriber, or dynamic aggregation of such collected data 
from distinct stateful Web services. Moreover, dynamic changes assisted by the 
middleware may take into account, a) The context of the provided service, e.g. 
service availability, or application specific characteristics. For instance, in the 
particular domain of Web enabled WSNs, such characteristics may be the status 
of the current subscribed topics to particular WSNs. b) The context of the in- 
teraction medium among the stateful Web service and its users, e.g. the current 
QoS of the underlying communication medium limited by network bandwidth 
or congestion, c) The context of these users, e.g. users accessing a stateful Web 
service through a mobile device with limited autonomy or processing power. 

Moreover, the solution uses the concept of a Session to capture the character- 
istics relating a set of users accessing the same particular service with the same 
interaction model. The Session concept supports hence the modelling of stateful 
Web service/users interactions promoting its reuse and adaptation. Namely, on 
one hand, the owner of a session may, at run-time, explicitly change the inter- 
action model to the service, being this automatically perceivable by the other 
users in the same session. On the other hand, the dynamic modification of the 
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used interaction model within a session may be triggered by the middleware 
itself and according to a state machine following a set of pre-defined rules. This 
provides limited forms of coping with failures or guaranteeing some consistency 
characteristics, as a result of changes in the context of a session (which comprises 
the service, its users, or the communication medium as enumerated above). 

Additionally, the novel work described in this proposal concerning session- 
based richer interaction models for stateful Web services, opens several interest- 
ing further developments concerning this context. For example, a) the possibility 
of accessing other Web services beside the ones supported; namely, work is al- 
ready under development to port the proposed Session abstraction to the context 
of Cloud computing; b) extension of the state-machine managing the imple- 
mented dynamic reconfigurations with additional user defined rules at runtime; 
c) aggregation of several service interactions with the described characteristics 
capturing their dependencies in the form of workflows; this is also being imple- 
mented in the context of a workflow engine. 

In our opinion, the proposed solution and cited extensions pave the way for 
an useful approach towards dynamic adaptations on interfacing stateful Web 
Services, and hence contributing to service systems dynamic evolution in the 
context of Services Sciences. 
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Abstract. Privacy could play a key role for digital identity protection and 
security, which are becoming major needs for individuals, organizations and 
societies. Digital identity management functionalities are increasingly delivered 
as sets of services, rather than monolithic applications. So, an identity layer in 
which identity and privacy management are interoperable could be more 
realistic and an acceptable situation in the context of distributed environments. 
Such interoperability could be offered through the design of a set of loosely 
coupled, publicly hosted and available to on-demand calls services and the 
implementation on open standards basis. The aim of the article is to disassemble 
digital identity-related privacy requirements that are drawn from global, 
domestic and business-specific privacy policies into a set of eight ready-to-use, 
granular and loosely coupled services that could accommodate a service- 
oriented architecture (SOA). OMG SoaML service architecture, service contract 
architecture, message type, service contract choreography, composite 
application components, and provisioning diagrams are provided. 

Keywords: Digital identity, privacy requirements, services design, SOA, 
SoaML. 



1 Introduction 

Service-oriented economy imposes new ways of relating to their customers. In such 
economy, anonymous transactions are rare and a service provider has to know something 
about the digital identity of a service receiver such as name, preferences, and attributes 
that are digitally transferred across the network. In such economy, digital identity 
management is emerging as a pervasive infrastructure, within, between, and across 
organizational boundaries and it is highly perceived as a security pillar and a predicate for 
corporate governance [1-4]. 

Identity and privacy should be interoperable and distributed through the adoption 
of service-orientation and implementation based on open standards. Identity 
functionality is increasingly delivered as sets of services, rather than monolithic 
applications. It is hard to create an identity layer for the internet mainly due to the 
little agreement on what it should be done and how it should be run. The lack of 
agreement arises because digital identity is contextual in nature. Thus the emergence 
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of a single simplistic universal digital identity solution is not realistic [5]. Privacy is to 
be engineered to integrate identity from the start, rather than attaching it to identity 
after the fact. It is confirmed that building secure systems requires privacy 
principles/policies to be taken into consideration from the early stage [4, 6]. Design 
must start from maximum of privacy is one of the design principles of European 
PRIME Project [7]. Organizations are realizing that they need better security, 
particularly identity & privacy management through a better interoperability both 
within and between countries. Interoperability is not just technical interoperability but 
the alignment of policy, services and processes with business requirements [8]. 

This article is organized as follows. In section 2, we explain the need of 
interoperable privacy and digital identity management functionalities and we describe 
the target system. In section 3, we specify DigldeRP requirements that we draw from 
privacy policies. In section 4, we introduce OMG SoaML modeling language and we 
disassemble DigldeRP requirements into a set of eight services. We provide a range 
of SoaML diagrams to illustrate the design and pre-implementation steps. Finally, we 
conclude and present future work in section 5. 



2 Digital Identity, Privacy, and Interoperability 

Privacy is a complex and subjective concept that has with different meanings to 
different people when used in different contexts [9]. It is often used to refer to some 
quite specific need or expectation, such as freedom from the attention of paparazzi, 
protections against voyeurism such as the use of mobile cameras in change-rooms. 
One of the most common narrow usages of privacy is to refer solely to privacy of 
personal data, or sometimes the combination of that with privacy of personal 
communications. The computer scientists [10] identify three elements of privacy: 
“being able to make your own decisions and hold your own views without 
interference; controlling information about yourself; and being in charge of your 
personal space”. 

There is a strong bound between identity and when privacy is compromised security 
of the individual, the organization or the country could be threatened [11]. 
Digitalization gives to the Internet the power by allowing several virtual representation 
of reality, including that of identity. Digital identities and user profiles allow to 
individuals accessing online services and for this reason they become valuable assets. 
Protecting and securing digital identities and profiles becomes an urgent need for 
individuals, organizations and societies. With the lack of identity protection, people 
would be susceptible to identity theft, fraud and business closing through denial of 
service attacks. Preserving privacy could contribute to protect digital identity and avoid 
damages related to it such as unauthorized access, frauds, identity/profile data theft and 
harmed reputation. In addition, privacy could reduce power and control to 
organizations/individuals, which possess and collect personal information. 

We adopt service-orientation in order to ensure interoperability within distributed 
privacy and digital identity systems. Thus, privacy requirements coupled with service 
orientation considerations should be incorporated into a digital identity management 
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system from the requirements specification and the very outset of the design process 
[4, 11]. In other words, privacy should be engineered and integrated from the start, 
rather than attaching it after the fact. In addition, user-centric digital identity 
federation technical model [12] aspects are also to be considered as soon as the 
project begins. More details about user-centricity are available further in sub-section 
2.1. In general, when decomposing the community into specialized, individual outlets, 
we will be able to achieve an environment in which outlets can be distributed. Thus, 
privacy should have a service-orientation to respond adequately to service economy 
and context. Many service and SOA definitions are suggested in the literature. Here, 
we adopt the definitions provided by SoaML specifications. The service is defined as 
“an offer of value to another through a well-defined interface and available to a 
community” and SOA as “an architectural paradigm for defining how people, 
organizations and systems provide and use services to achieve results” [13, 14], 

2.1 Digital Identity-Related Privacy Set of Services: The Target System 

The target system encloses a set of services that is designed as a consequence of 
decomposition from digital identity-related privacy (DigldeRP) requirements. In-rest 
and in-action represent the possible states of the services. The fist one is represented 
by a horizontal arrow and it refers to an inactive and a ready-to-use service that is still 
not invoked by a party. The second one is represented by a vertical arrow and it refers 
to an active service that is invoked by a participant. In this state, a negotiation and 
communication channel is established between the parties: service sender and service 
receiver(s). If the negotiation is a success, the service is consumed and if it is a 
failure, the service is released. The dash line eclipse delimits services 
hosting/deployment environment that could be any machine, a set of distributed 
machines, an SOA, or a cloud computing environment (see figure 1). The eclipse 
represents also the circle-of-trust among digital identity federation’s participants: 
subject, service provider (SP), and identity provider (IdP). 




Fig. 1. DigldeRP services 
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User-centric identity federation is a novel and promising approach that provides 
more control over digital identity [15]. OECD report [12] provides a description of 
user-centric identity federation technical model in which the subject send a request to 
SP to have a service. The subject could be a person, a machine, or an object that 
expresses the need to have a service such e-payment, transaction to buy an item 
through an e-commerce gallery and document download. The SP responds that it 
needs a set of subject’s digital identity attributes. The subject provides IdP(s) 
address(es) to be contacted to have the required attributes. The SP won’t receive 
attributes unless the subject sends attributes release consent to IdP(s). The SP 
consumes attributes and sends the service back to the subject. Multiple SPs and IdPs 
could share the same digital identity federation within a circle-of-trust. 

The services descriptor directory system plays the role service discovery system, 
which describes all available services in term of a service’s objective, a detailed 
description, a hosting system address, constraints, etc. and allows service access by 
the participants. 



3 Digital Identity- Related Privacy (DigldeRP) Requirements 

It is confirmed that Digital identity related privacy (DigldeRP) requirements are to be 
specified from privacy policies and such requirements are to be taken into 
consideration from an early stage of the project [4, 16] 



3.1 Privacy Policies 

They are classified into three main categories: 1) global privacy policies: CDT’s 2007 
Privacy Principles for Identity in the Digital Age, OECD’s 1980 Guidelines on the 
Protection of Privacy and Transborder Flows of Personal Data, OECD’s 2008 Data 
Protection and User Control for Identity Management Systems, and (95/46/EC 1) 
European Union Data Protection Directive; 2) domestic privacy policies: The United 
States Privacy Act of 1974, CSA Model Code for the Protection of Personal Information 
of 1996, the Canadian Personal Information Protection and Electronic Document Act of 
2000, the Canadian Privacy Act of 1983, the Japanese Act on the Protection of Personal 
Information of 2003, and the Australian Privacy Act of 1998 (Private Sector); and 3) 
business-specific privacy policies: the 1996 Health Insurance Portability and 
Accountability Act and the 1999-Bliley Financial Services Modernization Act. 



3.2 DigldeRP Requirements Specification 

We draw DigldeRP requirements from policies of three types of initiatives regarding 
privacy: global, domestic, and business-specific privacy policies related to digital 
identity. Digital identity systems should be fully designed in accordance of DigldeRP 
requirements: 1) purpose specification: digital identity attributes that have been 
collected shall be associated with the purpose. As a consequence, attributes processing 
or communication should be in a consistence with the purposes for which attributes has 
been collected. The purpose of the system and the purposes for which identity 
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information will be collected and used should be directly linked; 2) consent for 
attributes usage/release: the individual provides his consent for usage of the attributes 
that they have provided for the specific purpose. For instance, a user can give consent 
for his attributes to be released for medical research purposes. Individuals should be 
notified when other information is gathered about them and linked to their identity; 3) 
limited usage of attributes: attributes that are collected shall be limited to the minimum 
necessary for accomplishing the specified purposes. For instance, requirement of bank 
account number for medical records is absurd. Identity, authentication, and linked 
information should be used, shared and retained only for the specific purposes for 
which they were collected/shared/retained; 4) limited retention of attributes: attributes 
shall be retained only for the necessary period of the purpose’s fulfillment for which it 
has been collected. For instance, a patient medical history can only be retained for a 
period of 12 months after the treatment, unless the patient has given attributes release 
consent for research purpose; 5) accuracy of stored attributes: attributes that are stored 
in the database shall be accurate and up-to-date. For instance, administering a wrong 
medication to a patient due to outdated attributes in his medical record may cause 
serious injury and illness; 6) openness: the individual should be able to access to his 
stored data. Attributes should be easy for individuals to access, view, understand and 
change. Individuals should also be able to challenge conclusions drawn from digital 
identity aggregation. Whenever possible, individuals should be able to see when their 
identity attributes has been disclosed and to whom; 7) authentication and enrollment 
needs: individual’s enrollment and authentication should be with different identities for 
different purposes. Using a single identifier or credential for multiple purposes creates 
a single target for privacy and security abuses. When linking attributes within different 
systems is deemed necessary, appropriate safeguards should be implemented to limit 
the associated privacy and security risks; 8) choice and terms of the contract: a system 
should offer individuals reasonable, granular control and choice over the attributes and 
identifiers needed to enroll in the system and the credentials that can subsequently be 
used within the system. Moreover, if an individual declines to accept the terms of 
contract, no information should be collected; 9) secondary use: secondary use, sharing, 
and sale of identifiers or credentials should not be permitted. Thus, multiple uses of 
identifiers and credentials should be avoided particularly in the authentication context. 
Identity, authentication and linked information should be shared with third parties 
including data transfers between government and commercial entities only when 
necessary, and should be stored by third parties only until the purpose for which it was 
shared has been completed; and 10) compliance: an individual should be able to check 
privacy compliance with the above principles [16]. 



4 SoaML-Based Modeling of DigldeRP Requirements 

DigldeRP requirements are decomposed into a set of eight granular and loosely 
coupled services. 



4.1 OMG SoaML: Service Oriented Architecture Modeling Language 

SoaML specification describes UML profile and metamodel for designing architectures 
with a service orientation. The specification extends UML2 to support the activities of 
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service modeling and design and to fit into an overall model-driven development 
approach that helps to map a business model through logical and physical models into a 
resulting in technology implementation. Among others, SoaML goals are: 1) identifying 
services, functional capabilities, requirements and dependencies between the services; 
2) defining service consumers and providers; 3) and policies for using and providing 
services. Particularly, the profile and metamodel accommodate different perspectives: 
service consumer perspective, service provider perspective, and system design 
perspective and describe consumers requirements, providers offerings and the 
interaction and agreements between them. SoaML serves organizations that are looking 
for a semantically rich notation in which to create abstract yet very precise definitions of 
their SOA Services, which can later be mapped to implementation artifacts [13, 14], 
Cameo™ SOA+ plug-in is integrated into MagicDraw UML modeler tool to perform 
SoaML-based design of services. 

4.2 DigldeRP Services Description 

DigldeRP Services Architecture Diagram. In the following diagram, figure 2, we 
present the participants that we’ve identified (subject, IdP, SP) and we highlight 
service contract type interaction between them. The service contract specifies the 
service without regard for its implementation [13]. It is the first step in the definition 
of services. The dash lines and labels represent the roles (consumer, provider) of each 
participant in the service architecture. 




Fig. 2. DigldeRP service architecture diagram 

Below, the eight service objectives are detailed. Methods are available either in 
consumer service interface or provider service interface. The latter can invoke 
methods that are available through consumer service interface and vice-versa. 
Moreover, different inputs of the methods are messages that are described in 
messages diagrams. 
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ServiceRequest Service. The service is available for subjects that are in need of 
services to be provided by SP through service interfaces: ServiceReceiver and 
ServiceSender interfaces (see figure 3). 




Fig. 3. ServiceRequest service contract and messages diagrams 

Purpose Agreement Service. The service could be called by the subject in order to 
set an agreement with SP on the purpose of identity collection, identity handling 
(retention) duration, and identity access capabilities (see figure 4). 



«ServiceContract» 

PurposeAgreemeiit 





«MessageType» 

sendPurpose 

+request : sendPurposeRequest 
+ purposeSpecification : String 
+identityRetentionDuration : date 



«MessageType» 

sendldP 

+purpose : sendPurpose 



«MessageType» 

sendPurposeRequest 

+ purposeSpeficationAttribute : String 



Fig. 4. PurposeAgreement service contract and messages diagrams 
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IdentityRequest Service. The service is available for SP in order to receive IdP(s) 
specification. IdP(s) will be required to transfer to the requester SP the subject’s 
identity attributes. The transfer is not possible if the subject has not given his consent 
(see figure 5). 




«ServiceContract» 

^ IdentityRequest 



\ 
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/ 

f 

I 
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\ 

\ 

\ 

\ 

\ 



\ 

\ 




Fig. 5. IdentityRequest service contract and messages diagrams 

Identity RequestConfirmation Service. The service is available for subjects to 
provide his decision on either allowing identity attributes transfer to the SP or 
declining such transfer (see figure 6). 



«ServiceContract» 

IdeiitityRequestCoiifirmation 




«MessageType» 

sendldeiititySendingCoiifirmation 


«MessageType» 

sendldeiitityReguestCoiifirmation 


♦request : sendldentitySendingConfirmation 


♦infoSentld entity : String 
♦purpose : sendPurpose 



cMessageType* 

sendldentitySendingcanceling 

♦request : sendldentitySendingConfirmation 



Fig. 6. IdentityRequestConfirmation service contract and messages diagrams 
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EnrollmentRequest Service. This service is available for the subject to make an 
enrollment allowing him to delegate digital identity management at the IdP. The 
subject has also the capability to check digital identity attributes (see figure 7). 




«MessageType» 

sendldentity 




«MessageType» 

receiveldentity 




«MessageType» 

sendDisplayldentityRequest 




«MessageType» 

sendDisplayedldentity 


+termsOfContractlnfo : String 




+attributes : sendldentity 




♦access : boolean 




♦request : sendDisplayldentityRequest 



Fig. 7. Enrollment service contract and messages diagrams 



ProfileToChallengeRequest Service. This service is available for the subject to be 
able to access and challenge his profile that is in hold by SP (see figure 8). 




«ServiceContract» 

Pi of ileT oChallengeRequest 




«MessageType» 




«MessageType» 


sendProflle 




sendProfileToChallengeRequest 


♦request : sendProfileToChallengeRequest 




♦authenticated^ : String 



Fig. 8. ProfileToChallengeRequest service contract and messages diagrams 
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IdentityToUpdateRequest Service. This service is available for the subject to make 
the desired changes and updates of digital identity attributes (see figure 9). 




«ServiceContract» 

Identity T ollpdateRequest 
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/ 



/ 



I 



I 
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«MessageType» 

SendldeutityT ollpdateRequest 




«MessageType» 

SendldeutityT ollpdate 




«MessageType» 

identity 


+NewattributesValues : identity 




+request : SendldentityToUpdateRequest 







Fig. 9. IdentityToUpdateRequest service contract and messages diagrams 

PeriodicIdentityToUpdateRequest Service. This service is available for IdP to 
make a automatic and periodic digital identity attributes updates. Subjects are already 
given to IdPs their consent to proceed for update operation (see figure 10). 



«ServiceContract» 

PeriodicldentityT ollpdateRequest 




cMessageType* 

sendPeriodicldeiitityToUpdate 




cMessageType* 

sendPeriodicldentityTollpdateRequest 




cMessageType* 

identity 


+newAttributesValues : identity 

+request : sendPeriodicldentityTollpdateRequest 




+identityUpdateFrequency : date 















Fig. 10. PeriodicIdentityToUpdateRequest service contract and messages diagrams 
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4.3 DigldeRP Service Choreography Diagrams 

Services choreographies describe the cooperation between available services, more 
specifically between service interfaces, to respond to participants’ needs. In this 
article, we provide only a only the PurposeAgreement service choreography (figure 
11), which highlights the negotiation and communication process between service 
interfaces in term of calls of methods. 



«Servicelnterface» 




«Servicelnterface» 


consumer : PurposeSender 




provider : PurposeReciever 



1 : sendPurposeRequest() 







2: sendPurposeO 








alt I 




;nt purposel sendldPQ 






[else] 


4: rejectPurposeRequestO 






; 









Fig. 11. PurposeAgreement service choreography 



4.4 DigldeRP Services Pre-implementation Step Diagrams 

In the pre-implementation step, we provide and describe, through composite 
application component diagram (figure 12), different components to be implemented 
further and we specify service channels that link service points and request points. 





<Participant» 

Subject 


a 






«ServicePoint» 


«Sen/icePoint» 


S 


SenriceRequest P 


~] spe : ProfileToChallengeRequest 




«ServicePoint» 




cServicePoint* 



«ServicePoint* 

ser : EnrollmentRequest sp : PurposeAgreement Q 
□ 



«ServicePoint» 

□ s[u : IdentityToUpdateRequest , RequestPolnU 

rirc : -IdentityRequestConfirmation Q 

cRequestPoinU 

rpiu : -PeriodicldentityToUpdateRequest 
□ — 



«Participant» 

ServiceProvider 


a 


•RequestPoint* 


cServicePoint* 


H] r : ~ServiceRequest sir 


IdentityRequestP 


cRequestPoint* 




rp : -PurposeAgreement 


cRequestPoint* 


rpc : -ProfileToChallengeRequest [j 



eParticipant* 


a 


IdProvider 





cRequestPoint* 

Q rer: -EnrollmentRequest 



cRequestPoinU 
rir: -IdentityRequest [J 



cRequestPoint: 

ServicePoint* riu : ''IdentityToUpdateRequest Q 

P~1 sire : IdentityRequestConfirmation 

cServicePoint* 

spiu : PeriodicldentityToUpdateRequest (| 



Fig. 12. DigldeRP composite application component diagram 



Disassembling Digital Identity-Related Privacy into a Set of Services 



55 



Service channels are clearly represented in this diagram through service interface 
name and its correspondent conjugate service interface name. For instance, 
Pupose Agreement and its conjugate -Pupose Agreement. The composite application 
component diagram is a platform-independent diagram; however, the provision 
diagram (figure 13) is a platform-dependent one. The three components that are 
enclosed in DigldeRP composite application component diagram are transformed into 
three JEE Web services that are deployed within GlassFish JEE application server. 
Service channels and points are transformed in provision diagram into eight web 
services interfaces (DigldeRP services) that are represented with line connections. 




Fig. 13. DigldeRP Provisioning diagram 



5 Conclusion and Future Work 

With the emergence of service-oriented economy and cloud computing, many 
software industry experts and evaluators are encouraging the development and 
adoption of service orientation as a mean of interoperability. In addition, it is 
recognized that technical initiatives, emerging standards and protocols are not enough 
to guarantee resolution for the concerns surrounding a multi-facets and complex issue 
of identity and privacy. A technical approach is not sufficient enough to tackle 
privacy issues. Law, policies, regulations and technologies must be crafted together. 
DigldeP requirements are drawn from global, domestic and business-specific privacy 
policies and they should be incorporated from the very outset of the project. We’ve 
shown in this article how we’ve turned DigldeP and user-centric requirements into a 
set of eight services that could accommodate SOA in response to the service-oriented 
environments needs. SoaML service architecture and service contracts diagrams were 
the starting point that helped to specify service candidates. 
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SoaML modeling capabilities support the service “contract-based” and “interface- 
based” approaches, which follow the “ServiceContract” and “Servicelnterface” 
elements [17]. In this project, we adopted the service contract-based approach, but in 
the near future, we intend to explore the other approach and compare it to this. We are 
willing also to find a business process modeling notation/language such as BPMN 2.0 
that could help to make the requirements clearer and easier to automate in accordance 
to service orientation. 
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Abstract. This paper proposes an ontological definition of services. Such a 
definition is one of the fundamentals of service research. The understanding of 
essentialities of the notion of services as its definition, which differentiates 
services from the other notions, contributes proper modeling and 
conceptualization of services in services design and knowledge management of 
services. The existing definitions and characteristics of services, however, 
cannot differentiate services from other concepts: especially function of 
product. In this paper, we propose a new definition of services based on 
ontological consideration. Our definition can differentiate services from product 
functions. Firstly, we discuss the problem of the existing definitions and 
characteristics about the distinction. Secondly, we explain our definition and the 
essential characteristics of services using an ontological model of services. 
Lastly, we demonstrate its applicability of our definition using some examples 
and compare it with the existing definitions. 



Keywords: definition of services, services ontology, meta-services, function. 



1 Introduction 

The definition of the notion of services is one of the fundamentals of service research. 
Especially, in order to establish and develop a new discipline of services such as the 
Service Science [1], we need to reveal essential characteristics of services that 
differentiate services from other notions. In fact, in the early period of the research of 
services marketing, many researchers have compared services with (physical) goods 
to establish the services marketing as a new independent discipline from the 
traditional goods marketing [2]. Then, they have revealed some characteristics of 
services and defined the notion of services in their own way. Yet there is still no 
widely accepted definition of services [1 ]. 

The existing definitions and characterization of services are, however, insufficient for 
the differentiation between services and other related concepts such as functions. In most 
studies, the characteristics of services are taken as intangibility, heterogeneity, 
inseparability, and perishability (IHIP) in terms of the comparison between services and 
goods [3, 4], As discussed in Section 2 below, the IHIP is not specific to “service” rather 
than “process”, which are one of the aspects of functions. Although IHIP nicely 
differentiates services from products, it does not adequately describe differences between 
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services and functions, because functions also have characteristics of process and satisfy 
all these four. In fact, some prominent service researchers pointed out the problem with 
associating IHIP with the essential characteristics of services [4], 

In addition, from a practical point of view, it is also important to understand the 
essential characteristics of services in order to establish appropriate models of 
services and service ontologies for service design and to manage knowledge of services 
(knowledge management for services). Use of the concepts defined in a services 
ontology enables us to describe the models of services for increasing the interoperability 
and reusability of the models. The notion of services is a fundamental in both the models 
and the ontologies of services. If the definition of services that the models are based on 
does not capture the essential characteristics of services, the models of services will miss 
the crucial conceptual elements of services. 

Thus, in this paper, we discuss essential characteristics of services through the 
comparison between the services and product functions, and then propose a new 
definition of the notion of services. Through these discussions, we answer the 
question: “are services functions?” in the title of this paper. By “Functions”, we mean 
not only functions of products but also those performed by humans. 

This paper is organized as follows. In Section 2, we analyze definitions of services 
found in the existing research and describe their fundamental concepts. Based on this, 
we show that the differentiation between services and product function in the existing 
definitions is insufficient. In Section 3, we propose our definition of services and 
characteristics differentiating between services and product functions. In Section 5, 
we provide a final summary of this research and look at future prospects. 

2 Analysis of Definitions of Services 

2.1 Similarity between Services and Product Functions 

By analyzing the existing definitions of services in the literature, we derive conceptual 
characteristics, and then reveal some fundamental concepts of services. For example, 
Shimomura et al. defined services as follow: “Service is defined as a deed between a 
service provider and a service receiver to change the state of the receiver ” [5], We can 
derive the characteristic of process from the phrase “change the state” because process 
involves some state-change. 

We analyzed the definitions from 15 papers [5-19] in the various fields of service 
research and have derived 45 characteristics. Table 1 shows a part of correspondences 
between those definitions and those derived characteristics. To analyze the 
fundamental concepts, we grouped the characteristics associated with the same 
concepts and came up with three groups: process, provision, and value. By process, 
we mean a temporal change of a state and, consequently, which includes the 
characteristics of action, state-change, performance, intangibility and so on. By the 
provision, we mean that an agent provides something to another. This concept implies 
the existence of a provider and a receiver, and, consequently, includes characteristics 
such as provider (person), receiver (person), and others. Finally, the value is a 
concept associated with evaluation of usefulness (value, benefit and request) from the 
receiver’s perspective. Consequently, the value includes characteristics such as 
providing value/profit, fulfillment of expectation and so on. 




Table 1 . Correspondences between existing services definitions and the derived characteristics (Partial) 
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Looking at the derived concepts ( process , provision, and value), we see 
considerable similarity between services and product performance functions. For 
example, the relaxing function of a massage machine is related to a process to relax 
the muscles of the user and is provided from the massage machine to the user. And, 
the value of the massage machine lies in this function. 

The concepts of services and product functions have the same conceptual structure. 
We define the product function concept as “a result of teleological interpretation of a 
behavior (i.e., state-changes) of the operand(s) under an intended goal” [20]. The 
relation that the product brings about state-changes in the operand corresponds to the 
provision and process in the fundamental concepts of services. Moreover, the value of 
product functions and services corresponds to each other because they both are based 
on some purpose such as a request. From these correspondence relationships, we can 
say that services and product functions have the same conceptual structure. 

Yoshikawa and Shimomura et al. have already pointed out the similarity between 
services and product functions. In particular, Yoshikawa asserted that “a service is 
manifested function” [18] and this is an essentiality of services. These suggest the 
validity of comparing services and product functions. 



2.2 Problems with the Characteristics and the Existing Definitions of Services 

As mentioned above, existing characteristics and definitions of services are insufficient in 
terms of the distinction between product and services. Here, we point out the problems 
through an analysis of some familiar examples. 

Intangibility, heterogeneity, inseparability, and perishability (IHIP) focus on the 
process aspect of services and the physical aspect of products. Intangibility denotes 
the services are intangible because they are processes as temporal changes of states, 
thus do not have physical shape. Next, inseparability denotes that the production and 
consumption processes of services occur at the same time. For perishability, a process 
only exists during its performance. And heterogeneity denotes the quality of services 
are uneven because, unlike product, it is impossible to check the quality of services 
before use due to the inseparability. Thus, IHIP is not the exclusive characteristic of 
services but the characteristics common to processes. 

These characteristics are derived focusing only on the physical aspect of products. 
Strictly speaking, however, a product is composed of both product as a physical thing 
and that as product functionality. The product functionality is one of the essential 
properties in the product concept. For example, a chair as a product has a person-support 
function. If a chair leg breaks, the chair is not able to perform that function. Then, the 
chair will no longer be recognized as a product. Thus, the comparison between services 
as processes and products as physical objects is insufficient in order to understand the 
essential characteristics of services. We have to compare services with product functions. 

In fact, the existing definitions of services cannot differentiate between services 
and product functions. For example, Zeithaml et al. define services as “deeds, 
processes and performance provided or coproduced by an entity or person for 
another entity or person ” [19]. This definition cannot differentiate services from 
product functions, because a product function is a process or performance, and is 
provided by a product as an entity for another entity or person. In Section 5, we 
discuss a comparison among our definition and the existing definitions in detail. 
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As we see thus far, the distinction between services and product functions has not 
been revealed yet. In the next section, we propose a definition of services that can 
differentiate services from product functions. 



3 Our Definition and Essential Characteristics of Services 

3.1 Our Definition of Services 

We define services as follow. 

Definition: 

A sendee is an execution-environmentallv situated (A ~ I) function detached from the 
function performer from user ( customer)’ s point ofview {B ~ >] . (By function, we here 
mean any goal-oriented effect-giving operation performed by any kind of agent) 

Supplements: 

( 1 ) A service provider (a) guarantees and advertises the quality of the services (C) , (b) 
designs the sendees contents and trains the sendee performers, and (c) designs 
execution-environment to maximize the value of the resulting effects. (A ' 2) Thus, 
the sendee provider sells the right to use/access to such a function that is 
expected to be nicely executed in the predesigned environment (that is, “an 
execution-environmentally situated function” j. (A ~ 3) Customers are interested 
primarily in the quality of the function rather than the function perfonner, and 
hence the detachment of function from the function peiformer is realized. (B ~ 2> 

(2) There exists a multiple-layered structure of sendees where a sendee at the higher 
layer enables a service/function at the lower layer. The bottom layer corresponds 
to daily events in which customers usually participate. It can be a sendees or a 
(product) function. 

(3) When the sendee is intended by the sendee provider, then it is an essential 
sendee, otherwise an accidental sendee. 

In our definition, services are regarded as a special type of functions in a broad sense 
above. This is the answer to the question: “are services functions?’’ and the conditions 
described in the definitions shows characteristics specific to service as a special type 
of function. Our definition is based on a model of service systems and the two main 
characteristics that differentiate between services and product functions: the 
designability of the environment and the detachment of the function from the function 
performer. The phrases of underline (A) are based on the former, and the phrases of 
underline (B) are based on the latter. The supplements and some terms such as “ sendee 
provider” and “function performer” and so on are based on our model of service 
systems. Based on these characteristics, our definition can distinguish services from 
product functions, which are “functions” in a narrow sense and another special type of 
the “function” in a broad sense above. 

In Section 3.2, we explain our model of service systems. In Sections 3.3, 3.4 and 
3.5 we explain those essential characteristics of services. 




Are Services Functions? 



63 



3.2 A Model for Comparing between Services and Product Functions 

In order to compare some concepts correctly, it is important to clarify perspectives to 
capture them. We clarify our perspective to services and product functions in the way 
to develop a general model that represents services and product functions. By using 
this model shown in Fig. 1, we can compare them from a consistent perspective. 

This model is composed of function 1 , function performer, operand, provider, 
beneficiary, and environment. It is an extension of Kotler's Service Marketing Triangle 
[21]. The Kotler’s model is composed of firm, employee and customer: firm, employee 
and customer correspond to provider, function performer and beneficiaiy/operand in our 
model, respectively. 

The function consists of a state-change of the operand and a goal, and it is based on 
our definition of function [20] as mentioned in Section 2.2. Th e function performer is an 
agent to perform functions. Humans and products can be function performers. The 
operand is a target of the function. The provider prepares function performer and 
environment where the function is performed. Our model has a multiple-layered structure 
of functions, which is called meta-base layer. The beneficiary is an agent who gains 
some benefit from the performance of function, and the provider advertises and 
guarantees the quality of the function to the beneficiary. The underlined phrase’^ in the 
supplement (1) captures this. 



Preparation 



Advertisement, 

Guarantee 




Function performer 



Function performer 



Enable 



Stat 



ate before 



State change 



(Base) Function 



Environment 




State change 



Fig. 1 . The general model of service systems and product function systems 



The meta-base layer represents the relationship that a function enables to perform 
another function. A function that enables others to work is called a meta-function. A 
function that enables no function to work is called a base-function. Base-functions are 
demanded by beneficiary directly or indirectly, and are performed in daily events in 
which customers usually participate. For example, the case of the massage salon services, 



1 By “function”, we here mean the goal-oriented effect that includes the product function and 
performance of services by humans and products. 
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the base-function is the massage-relaxation function performed by the massager and the 
meta-function is taking a reservation of the massager prior to giving a massage. The 
supplement (2) in our definition captures this. 

We can explain service systems based on this model. Service companies are 
regarded as providers, and each of them is called a service provider. The service 
providers prepare the function performers: employees or equipment in the services 
(e.g. hiring and training employees, installing equipment, and designing service 
environment). The underlined phrases <A_1 ' A 2) in the definition is based on this. They 
also advertise and guarantee their services to customers, which are the beneficiary in 
this model. The operand depends on services; in a massage service, customers 
themselves are regarded as beneficiaries and in a laundry service, their clothes are 
regarded as operands. The underlined phrase (C) in the definition captures this. 

Similarly, we can explain how product functions are represented by this model. 
The function of a product becomes available to a user once the maker (or sales outlet, 
regarded here as an integrated function performer) sells the product to the user. 
Consequently, we can regard a product function as a base-function and sales function 
as a meta-function. We use the proposed model to capture a product function. Here, 
because a product performs a product function, the product is regarded as a function 
performer and the maker that designs and manufactures the product as a provider. The 
user of the product enjoys the product function. So the user is regarded as a 
beneficiary. We can then regard the target of a product function as an operand. 

Compared with Kotler’s model, our model divides the customer concept defined in 
Kotler’s models into two parts: beneficiary and operand. By dividing the customer 
concept into two objects, the semantics of the model become clearer. For example, in 
modeling a laundry service based on the Kotler’s model, we cannot identify the target 
of the laundry service whether clothes or customers of the laundry, while based on 
proposed model, we identify more clearly the clothes as the operands and the 
customers as the beneficiaries. Furthermore, based on studies about function [20], this 
model can express delivering services in more detail. The most significant value of 
this model exists in the introduction of the meta-base layer. 

3.3 Non-ownership 

To begin with, we consider some differences between services and product functions 
through some examples: services of massage salon as typical services, sales services 
of products, use of the products, rent-a-car services and use of the cars. 

Table 1 shows their meta-base structures and some significant attributes such as 
ownership, time, and place. In Section 3.2, we have already mentioned the meta-base 
layers of massage salons services and sales services. In the case of the car rent-a-car 
services, the meta-functions are the functions of lending the customer a car, and the 
base-functions are the car’s functions which is performed when the user drive the car. 
These meta-functions are apparently services. On the other hand, in the base-layers of 
them, while the base-functions of massage salon are services, the ones of sales 
services are product functions, and the ones of car rental seem to be intermediate 
between services and product functions. 
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Table 2. The restrictions caused by ownerships of function performers(FP) on uses functions in 
services and product functions 





Typical Services 
(e.g. Massage salon) 


Rental Services 
(e.g. Car rental) 


Sales Services 

(e.g. Massage machine sales) 


Meta-layer 


Meta 

function 


Transferring temporary use 
rights of base-FP 
(Taking a reservation) 


Transferring temporal use 
rights of base - FP 
(Lending a car) 


Transferring ownership of 
products as base-FP 
(Selling a massage machine) 


Owner of FP 
(FP) 


Providers 

(Receptionists) 


Providers 

(Clerks) 


Providers 

(Salespersons) 


Time 


Restricted 

(In the business hours) 


Restricted 

(In the business hours) 


Restricted 

(In the business hours) 


Place 


Providers’ side 
(In the salon) 


Providers’ side 
(In the shop) 


Providers' side 
(In the shop) 


Base-layer 


Base- 

function 


(Massaging) 


(Carrying something) 


(Massaging) 


Owner of FP 
(FP) 


Providers 

(Massager) 


Providers 
(Rented car) 


Beneficiaries 
(Massage machine) 


Time 


Restricted 

(Period of a massage service) 


Restricted 

(Lendincpenod^^_ 


Unrestricted 
(Anytime customers like) 


Place 


Providers’ side 
(In the salon) 


Beneficiaries’ side 
(Anywhere customers like) 


Beneficiaries’ side 
(Users’ room) 



There is a difference with respect to ownerships of function performers in these 
cases. In the cases of product functions, users as beneficiaries can use the functions of 
the products whenever and wherever they want, because they have ownership of the 
products. In the case of services, unlike product functions, customers as beneficiaries 
cannot use the services of service performers freely, because they do not own the 
service performers. They need some permission to use the services from service 
providers, who own the service performers. In addition, the service providers usually 
specify the situations where the services are performed in order to provide the 
services in the appropriate environments. We call that the beneficiaries do not have 
ownership of the function performers in services “non-ownership” 2 . The restrictions 
caused by the non-ownership, which is one of the major differences between services 
and product functions. 

We can explain the difference among the three cases in terms of non-ownership. In 
their meta-layers, whose functions seem to be services, the beneficiaries do not own 
the function performers. Thus, the time when the functions are performed is restricted 
within the business hours, and the place where the functions are performed is 
restricted to the providers’ side. For example, in the case of massage salons, the 
customers do not have the ownership of the receptionists. Moreover, the customer can 
make a reservation only in the business hours and at the reception desk in the massage 
salons. Next, in the base-layer of the massage salons, whose functions seem to be 
services, the customer also do not have the ownership of the massagers, thus the time 



2 By “ownership” here, we do not mean legal proprietary rights. For example, if a person 
obtains a loan to purchase a product, he may not have legal proprietary rights of the product 
until he pays off the loan. Even before paying off the loan, when he actually uses the product, 
he can do so as if he owned it. Consequently, “ownership” here means he can use the product 
freely like an owner anytime and anywhere — regardless of legal propriety rights — as if it was 
his own possession. 
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is restricted to the period of a massage, and the place is restricted to the massage 
salons. On the other hand, in the case of the shop that sells products such as massage 
machine, the base-functions are the uses of the massage machine at home and are 
regarded as product functions. The users own the massage machine, thus can use it 
anytime and anywhere as they want. Hence, the time and place are not restricted. In 
the base-layer of the car rental shops, while the time when the customers can use the 
car is restricted to the lending period, the place is not restricted but anywhere they 
want. That is the reason why these base-functions seem to be intermediate between 
services and product functions. Consequently, we regard the non-ownership as one of 
the essential differences between services and product functions, because it derives 
some essential characteristics of services as discussed below. 

3.4 Detachment of the Function from the Function Performer 

We explain differences related to the beneficiaries’ recognition of function and 
function performer. 

In the case of services, customers are interested mainly in the quality of function as 
services rather than the function performer. If the quality of a function fulfills the 
conditions of guaranteed quality of the services, the function can be a service regardless 
of who performs it. Let us take a fast-food restaurant as an example. If the employees can 
work according to the stipulated guidelines in the manual, the function performed by 
them is accepted as the guaranteed services regardless of who are in charge. Due to the 
anonymousness of function performers in services, the customers have a stronger 
awareness of the function than that of the function performers. Thus, they recognize that 
the function has become detached from the function performer 3 . In the case of product 
function, the users as beneficiaries own the products as function performers in which 
functions are embedded. So, to user, the function performer is not anonymous contrary to 
the services. Consequently, the users tend to be strongly aware of the function 
performers. This awareness of the relation between function performers and function is 
called the detachment of the function from the function performer. The underlined phrase 
(B_1) in our definition captures this. As can be seen from the above, this characteristic is 
derived from non-ownership. 

Section 2 describes how the IHIP characteristics do not contribute to identifying the 
differences between services and product functions. That is because those characteristics 
are common to both. We need to identify the difference between services and product 
functions. The idea of the detachment of function from its performer nicely explains how 
they are different and why service providers can sell services like conventional products. 
Such a detachment is realized, in the case of services, by customers’ strong awareness to 
function (especially, the aspect of process of function) rather than the function performer 
because of the anonymousness of function performers. In the case of product function, on 
the other hand, the user owns the product as function performer. So, he/she is strongly 
aware of the function performer. Due to this, there are an emphasis on and awareness of 
the physical characteristic of function performers. They are clearly derived from the non- 
ownership as fundamental natures of services. 



3 Of course, in services, the function performer is an important element to the customer, 
because the quality of services often depends on it. That is, however, a different issue. 
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Thus, we conclude that the (execution-environmentally situated) functions detached 
from the function performer are regarded as services, because, based on this 
characteristic, we can explain the occurrence of IHIP, which many researchers regard as 
characteristics of services. In addition, we should characterize services based on not IHIP 
but this characteristic, because this is more essential than IHIP for distinction between 
services and product functions. 

3.5 Designability of Environment 

Within services design, in order to enhance the result of the services, service providers 
design the environment where the services are performed. For example, in restaurants, 
the designers might design such a nice environment that the customers can enjoy the 
meals. In the case of product design, on the other hand, the designers of products can 
consider the environments where the users use the products, but cannot design them. We 
call this designability of environment. The underlined phrases (A_1 - A ' 2 - A - 3) j n our definition 
capture this characteristic. 

3.6 Essential Services and Accidental Services 

In the supplement (3) in our definition, the essential services and the accidental services 
represent the difference between providers’ perspective for the services and beneficiaries’ 
one. The essential services are intended by the service providers and the accidental 
services are intended not by the provider but by the beneficiaries. For example, in the 
case of coffee shops, a provider intends to provide the services which customers can 
drink coffee. However, if some customer uses the space for his/her meeting, the coffee 
shop unintentionally provides the services of the meeting space in the perspective on the 
customer. The distinction between the essential and the accidental is based on our studies 
about function [22], 

4 Some Examples 

In this section, we demonstrate that our definition can distinguish services from 
product function, and that our definition fits successfully some examples of services. 

4.1 Services and Product Functions of Massage 

To begin with, we look at massage services as a typical example to exemplify our 
definition and look at a product function of a massage machine to show the distinction 
between services and product functions. 

The massage functions (or services) are to eliminate the fatigues of the customers 
with massages. The massage services have the designability of environment, because 
massage salons as service providers usually design the environment of the massage 
salon in where the massage services are performed. The massage services satisfy the 
underlined phrases <A_1 ' 2 ' 3) in our definition, which are based on this characteristic. 
The massage services also have the detachment of the function from the function 
performer. If the masseurs can perform the services of which the quality fulfills the 
guarantee of massage services, the customers tend not to pay much attention to the 
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masseurs as function performers, and the anonymousness causes the detachment of 
the function from the function performer. This detachment is also caused in the case 
that automatic massage machines, which are products, perform the massage services. 
Because, the customers recognize the similar anonymousness, since the qualities of 
services that the massage machines perform are very even. Thus, the massage services 
satisfy the underlined phrases (B ’ 1 ' 2> based on this. The massage salons as service 
providers usually guarantee and advertise the quality of services. Thus, the underlined 
phrase (C, is satisfied. Here, we can explain the massage services satisfy our definition 
and supplement (1). We have already explained about the supplement (2) in Section 
3.2. The last is the supplement (3). The essential service in the massage salons is the 
massage service because the intention of massage service provider is to massage 
customers. The accidental services is depends on each a customer. If a customer uses 
the massage salon in order to have a nap, then the accidental services is the services to 
give a space where he can have a nap. As stated above, the massage services satisfy 
our definition. 

Next, in order to show that our definition can differentiate services from product 
functions, we consider the two characteristics: the designability of environment and 
detachment of the function from the function performer, through an example of the 
use of a massage machine at the user’s home. This case does not satisfy the 
designability of environment because the designers of massage machines cannot 
design the environment where the users use the massage machine. And this case does 
not satisfy the detachment of the function from the function performer. The user owns 
the massage machine, hence the massage machine as function performer is specific 
not anonymous for user as with services. Consequently, the user is strongly aware of 
the massage machine. If the same massage machine is, however, used in a massage 
salon, those characteristics are satisfied as discussed above and thus the massage 
machine provides services. 

Here, we showed that massage services, typical services, satisfy our definition, as 
well as that our definition can differentiate services from product functions. 

4.2 Automobile Sales and Use 

The next examples are the services of selling automobiles and using automobiles as 
product functions. The sales services of automobile enables that the users of the 
automobiles can use them. This relation is regarded as a meta-base relation as 
discussed in Sections 3.1 and 3.2. 

The function of the sales services is to provide the ownership of the product with the 
customers in exchange for money. The environments of sales shops including automobile 
sellers are usually designed for convenience of the customers. Sales services have the 
designability of environment and satisfy the underlined phrases (A_1, ~ 3) . And, sales 
services have the detachment of the function from the function performer, because the 
main purpose of the customers is the possession of the products, whose quality does 
not depend on the salespersons as function performers. The customers are not strongly 
aware of who is salesperson and then the salespersons are anonymous for the 
customers. Thus, the sales services satisfy the underlined phrases based on this. 
And, the underlined phrase (C) is satisfied because the sales shops usually guarantee 
and advertise the quality of service sales services satisfy the supplement (2). The 
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meta-base layer is mentioned in Section 3.2. On the supplement (3), if a customer 
uses the test-driving services of an automobile seller to play driving a newest model 
car, the automobile seller provides the accidental services lending the customer the 
newest model car. As stated above, sales services of automobile satisfy our definition. 

In the same way as Section 4.1, in the case of using an automobile as example of 
product function, we consider the designability of environment and detachment of the 
function from the function performer. This case does not satisfy the designability of 
environment because the designers of automobiles cannot design the environment 
surrounding the automobiles. Likewise, this case does not satisfy the detachment of 
the function from the function performer because the automobile as function 
performer is not anonymous but specific for user due to the user’s possession of the 
automobile. 

As discussed above, in the examples of automobile sales and using automobiles, 
our definition of services can correctly differentiate services and product functions 

4.3 Web Services 

Our definition of services can explain the web services, such as an Internet search 
engines. Web services satisfy the detachment of the function from the function performer 
and satisfy the underlined phrases <B-1 ' 2) . The server computers, which host such web 
services as function performer, are anonymous for the users, especially in the cloud- 
computing environment. The users are not aware of which server provides the services. 
The underlined phrase (C1 is satisfied because the web services providers usually 
guarantee and advertise the quality of the web services. Next, web services satisfy the 
supplement (2). The base-layer is the web services itself and the meta-layer is the 
services that the providers enable users to access the web services. On the supplement 
(3), if a customer uses the web services to confirm the connection to the Internet, the web 
services provide the accidental services enabling the users to confirm the connection. As 
stated above, web services satisfy our definition. 



5 Discussion 

In this section, we discuss the novelty of our definition shown in Section 3.1 with the 
comparison to some other existing definitions. 

Shimomura et al. define the services as follow: “Service is defined as a deed between 
a service provider and a service receiver to change the state of the receiver.”[ 5] This 
definition is essentially the same as the definition of function [20] as described in Section 
2.2. The provider is regarded as the function performer, and the receiver is regarded as 
the operand of function. The change of state of the receiver is regarded as the behavior 
(i.e. state-change). Thus, this definition is not the definition of the notion of “services” 
but the definition of the notion of “function” that is the general notion including 
“services” and “product function”. Our definition can make the distinction between 
services and product functions. In addition, our definition contains the new concepts that 
the existing definitions do not have, such as the meta-base structure of services and the 
essential/accidental services. 
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IBM defines the services as follow: “A sendee is a provider/client interaction that 
creates and captures value.”[\ 1] We suspect it mainly focuses on consulting services. 
It, however, also cannot differentiate the services from product functions in the same 
way as the definition of IBM. For example, the using a laundry machine fits this 
definition. When the user is using the laundry machine, there are some interactions 
between the laundry machine and the user, such as the user’ s operation of the laundry 
machine. And the interaction brings in the value of the cleaned clothes. By 
comparison with our definition, the definition of IBM also fails to differentiate 
between services and function 

Ferrario and Guarino define the services from a viewpoint of ontology engineering as 
follow: “A sendee is present at a time t and location l iff, at time t, an agent is explicitly 
committed to guarantee the execution of some type of action at location l, on the 
occurrence of a certain triggering event, in the interest of another agent and upon prior 
agreement, in a certain way.” [7] This definition also has the same problem about the 
distinction between services and product functions. Obviously, product functions are in 
the interest of user. Most of product functions embedded in products are sold along with 
the quality guarantee. In the product guarantee, the location where the product performs its 
function normally and a certain triggering event of performing functions such as pressing a 
run-button are described. In addition, we conceptualize the guarantee and the triggering 
events as the meta-services, which has the higher generality than the concepts of Ferrario 
et al. Moreover, Ferrario et al. take into account only the providers’ perspective, on the 
other hand, we take into account the both perspectives of the providers and the customers. 

Consequently, our definition is advanced over the existing ones with respect to the 
distinction between services and product functions and the new concepts that represent 
various services and perspectives, such as the meta-base structure of services and the 
essential/accidental services. 



6 Conclusion 

The purpose of our research is to clarify the essential natures of services that are 
important in the both academic and practical viewpoints. From the academic viewpoint, 
essentialities of services are one of the fundamentals of uniqueness of the service 
research. From the practical viewpoint, they are also the core elements of models and 
ontologies of services, which are important in the design and knowledge management of 
services. However, all the existing definitions of the notion of services have a problem in 
is the distinction between services and other related concepts: especially product 
functions. For example, the IHIP is not the exclusive characteristics of services but 
common to processes, which are aspects of functions. Thus, existing definition of 
services cannot answer the question: “are services functions?” 

In this paper, we proposed a definition of services through the comparison of 
services and product functions using a general model. In our definition, services are 
the special type of functions. The functions are general concepts that include not only 
product functions but also those performed by humans. Then, we clarified the two 
main differences: the designablity of environment and the detachment of the function 
from the function performer, which are regarded as essential natures of services. 
Based on them, we defined the notion of services and showed its advantages. 
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Based on the conceptual elements of services grasped through this research, we are 
currently building a services ontology and clarifying formal definitions and 
relationships between concepts. Then, we will describe service models that represent 
specific service structures and characteristics based on that ontology. We believe this 
can be achieved by expanding a functional modeling tool named OntoloGear [23]. 
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Abstract. In this paper we describe a service modeling project done at an IT 
department that provides IT services to a network of state owned healthcare 
providers in the state of Vaud in Switzerland. The goal of the project is to un- 
derstand how to maintain business continuity in the case of a disaster affecting 
the IT department’s data center. We analyze how to precisely relate the business 
requirements to the IT operation requirements with the help of the SEAM En- 
terprise Architecture method. The results are refined service levels and the 
identification of the required technical architecture. 

Keywords: Service System, Business Continuity, Service Modeling, IT 
Infrastructure, Healthcare, SEAM. 



1 Introduction 

FHV (www.fhv.ch) is the organization that coordinates most regional hospitals in the 
state of Vaud, Switzerland. It includes 12 hospitals (among them: hospitals providing 
emergency services, psychiatric hospitals, and hospitals specialized in re-adaption and 
in convalescence). In 2010, FHV provided 600K days of care. 



EFFECTIF 2010 - PAR CORPS DE METIER 




• Personnel soignant, secteurs de soins - 3'213 

• Personnel des aulres disciplines mddicales - 1 700 

• Personnel dconomat. transports et service de maison 925 
Mddecins et professions umversitaires 836 

• Personnel administratif - 644 

• Personnel service technique - 122 



Fig. 1 . FHV Employee Distribution 
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FHVi ( www.fhvi.ch ) is the internal IT provider of FHV. FHVi manages a centrally 
located data center that provides its services across the state of Vaud. FHVi also 
manages the IT infrastructures located in the 12 hospitals, spread all around the state. 
FHVi has about 50 employees (25 in application management and 25 in IT infrastruc- 
ture and support). They manage 300 servers (physical and virtual) and 3500 worksta- 
tions spread in the FHV hospitals. FHVi provides 80 IT services to the hospitals. 

FHVi works with external vendors that supply it with IT applications; these ven- 
dors provide executable code, documentation and, sometimes, IT services. Applica- 
tion managers are responsible to understand the user requirements, to manage the 
developments made by these vendors and to define a strategy for the application or 
service under their responsibility. Infrastructure managers are responsible for the ex- 
ecution, storage and communication infrastructure that host the applications. Infra- 
structure managers can specialize in a specific kind of infrastructure category e.g. 
virtual machines, storage, or network. 

In their risk analysis, FHVi identified that their single data center was a significant 
risk. If data center were to be damaged (by e.g., fire or flood), the services to the hos- 
pitals would be impacted very significantly for a very long period of time (months). 
For this reason, FHVi started a project for creating a backup data center located 
somewhere else in the state. The project was named psico (“plan secours informatique 
et de continuite’’). 

Prior to the psico project, FHVi already defined their IT service catalog. As a result, 
they identified 4 IT services that they provide, which are considered to be critical to the 
functioning of the FHV hospitals. These IT services must be provided even if the data 
center is damaged. These services are: medical imaging, patient medical management, 
patient administrative management, and laboratory management. The medical imaging 
service is supported by two applications: image processing application and radiology 
records application. 

FHVi defined three operational modes in connection with the risk of damage to the 
main data center: 

• Normal Mode - The data center runs properly. The hospitals can rely on 
its services for the services they provide to their stakeholders. 

• Disconnected Mode - This is a degraded mode that immediately follows 
an incident that brings down the data center. In this mode, the hospital is 
not connected to the data center anymore but can run autonomously (i.e. 
the hospital’s local infrastructure is not affected by the incident). For, ex- 
ample, if the data center is down, hospitals can still do radiology exams 
and look up for images in a one-year archive. In the disconnected mode, 
the hospital’s medical imaging systems run stand-alone. This means that 
they are not connected to the patient administrative management (so in- 
formation has to be keyed in by hand in the imaging device before doing 
an exam) or to the radiology records application (so no radiology diagnos- 
tics record can be entered or accessed). In the negotiation between hospit- 
als and FHVi, this level of service was considered as acceptable for 24 
hours but not for longer. 

• Psico Mode - In this mode the four critical IT services are provided in whole 
or part. For the medical imaging service, both applications (images and 




Modeling an Emergency Service System for a Hospital Network 



75 



records) must be available. The hospitals can work for weeks in this mode. 
The FHVi is in psico mode as soon as the backup data center takes over from 
the downed main data center. In this mode, the hospitals’ systems are not 
disconnected anymore but are connected to the backup data center. 

Initially, the psico project encompassed two subprojects: The backup site selection and 
equipment project and the IT Sendee Continuity (ITSCM) project. The initial goals of the 
ITSCM project were 

1. To bring together application managers with infrastructure managers so as to 
agree on a common understanding of the complete service delivered by the IT. 

2. To define the requirements for the reduced operation mode for the critical 
services described above. More specifically, in which sequence the IT sys- 
tems are to be resumed when the FHVi will switch from the main data center 
to the backup data center. 

3. To define the architecture necessary to support the requirements. 

In this project, we did not analyze other risks (such as a disaster affecting the hospitals). 
These risks are analyzed in the standard risk management process of FHV and FHVi. 

Following a presentation of the SEAM Enterprise Architecture method [2,3,13,16,17] 
given by the first author in an industry conference, FHVi invited him to help with the 
ITSCM project. A core concept of SEAM is the modeling and alignment of services. The 
services provided by an organization to its stakeholders are modeled and aligned with the 
services provided by the IT to stakeholders. SEAM was therefore found to be suitable for 
the ITSCM project. 

The ITSCM project was divided in two parts: a first series of 3 workshops was 
planned before the official kick-off of the project with the goal of scoping the project. 
A second series of 4 workshops was planned; workshops in which the business re- 
quirements were refined, the existing architecture was modeled, problems with the 
existing infrastructure were identified and the architecture of a solution was drafted. 
All workshops lasted half a day each and brought together between 5 and 10 people. 
The paper is organized as follows: In Section 2 we very briefly introduce ITSCM 
as described by the IT Infrastructure Library (ITIL) as well as SEAM. In Section 3 we 
explain the workshops we have run at FHVi and sketch the models created in these 
workshops. In Section 4 we discuss the findings and draw key learning points on ser- 
vice design. In Section 5 we briefly talk about related methods to SEAM. In Section 6 
we summarize the work done and describe the next steps for this project. 



2 IT Service Continuity Management and SEAM 

ITSCM is defined in ITIL [9] as “The Process responsible for managing Risks that 
could seriously affect IT Services.” ITIL further states that ITSCM depends on a 
broader process called Business Continuity Management (BCM). ITIL [9] describes a 
broad process for ITSCM; based on the assumption that most organizations either do 
not have a BCM process or that it is not really focused. This broad ITSCM process 
comprises the following activities: 
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Initiation (Policy Setting, reference terms and scope, resource allocation, 
project organization, project and quality planning) 

Requirements and strategy (Business Impact Analysis, risk analysis, IT service 
continuity strategy) 

Implementation (Recovery planning, testing) 

In ITIL, the Initiation and Requirements activities are part of BCM. ITSCM is only 
involved in these activities if they have not been done at all or not in enough detail so 
as to permit a good enough ITSCM. 

Two of the main issues to be defined in BCM are called the Recovery Point Objec- 
tive and the Recovery Time Objective. The Recovery Point Objective defines “the 
point [in time] to which data will be restored after recovery of an IT Service.’’ [10]. 
This defines in essence the maximum amount of hours of operation in which data that 
can be lost. [ 10] gives the example that with daily backups up to 24 hours of data can 
be lost. The Recovery Time Objective “describes the maximum time allowed for re- 
covery of an IT service following an interruption. The Service Level to be provided 
may be less than normal Service Level Targets.” [10]. 

Most of the work in this project consisted in understanding how the application man- 
agers, and infrastructure managers were architecting their systems and to what extent this 
architecture was compliant with the requirements of psico. One important result was a 
refined Recovery Time Objective. It turned out to be a fairly complicated curve, which 
reflects the architectural considerations (what can be implemented or not by technology). 

SEAM [15,16] is an Enterprise Architecture method designed from the ground up 
to model services and their implementation. SEAM was applied to the analysis and 
design of services in e.g. [2,3,13]. A SEAM model is typically made of several orga- 
nizational levels, beginning with an organization providing a service to a set of bene- 
ficiaries. At this top-most organizational level, the organization is modeled as a whole 
(a black box) with just the service it offers visible to its beneficiaries. In the next or- 
ganizational level the organization is viewed as a composite (white box). This level 
shows how the service is implemented. A succession of black boxes and white boxes 
can be represented until an organizational level that is meaningful to the stakeholders 
is reached. Through this hierarchy of service specifications and implementations, it is 
possible to relate the stakeholder’s views. In this paper, the SEAM model spans from 
the representation of the service provided by a hospital to the general population 
down to the virtual machines, storage and network infrastructure. SEAM is based on a 
simplified UML representation in which only a handful of concepts have been kept 
(e.g. a class, an activity, a relationship). We augment these concepts with pictograms 
that represent systems (e.g. boxed arrow, UML components, UML stickman, etc.). 
The same concepts are used across all organizational levels to model the service offer- 
ing and service implementation. Thus, the modelers only need to learn these very few 
graphical representations to model business and IT systems. This uniform representa- 
tion also helps to validate whether the business and the IT are aligned. SEAM has a 
specific way of modeling organizations as service systems. A service system is said in 
[15] to “make use of its own resources and the resources of others to improve its 
circumstance and that of others.” 

In the next section we describe the workshops and the models that were created 
including the way service systems are modeled with SEAM. 
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3 Workshops and Models 

As mentioned in the introduction, the seven workshops that were run during this 
project were divided in two parts: The project scoping and the analysis. 

3.1 Project Scoping Workshops 

The project scoping workshops were run with the head of FHVi, his direct reports and 
the key people who were foreseen as project managers for this project to implement 
the continuity strategy. The three scoping workshops took a total of 9 hours with ap- 
prox. 9 people in each workshop. These workshops helped scoping the project and 
defining that should be part of the ITSCM project team. 




Fig. 2. first sketch of service hierarchy (original workshop diagram): (a) service provided by 
hospital to population, (b) services provided by FHVi and doctors to implement hospital’s 
service, (c) services of applications, help desk and infrastructure to implement FHVi ’s servic- 
es, (d and e) services provided by technical components to provide infrastructure services. 
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In the first workshop we developed a SEAM model with 4 organizational levels. 
Figure 2 illustrates the model sketched during the first workshop. We modeled the 
services provided at each level. These are: 

• Services provided by an FHV hospital to the population (a in Figure 2), 

• Services provided by FHVi and the medical staff to implement the services 
provided by the FHV hospital (b in Figure 2), 

• Services provided by the applications and the infrastructure to implement the 
services provided by FHVi (c in Figure 2), 

• Services provided by IT technical components to implement the services pro- 
vided by the infrastructure (d and e in Figure 2). 

The benefit of this session was to build a common understanding in the team of these 
levels of systems that implement services. This was crucial to divide responsibilities 
later on. After the first workshop, the model was cleaned up and drawn on a flipchart. 

In the second workshop, this flipchart was used as canvas. The management team 
used post-it notes to populate the model. Yellow post-it notes represented existing 
elements. Pink post-it notes represented the change. The benefit of this workshop was 
a shared understanding of the project ‘scope. 

In the third workshop, the FHVi director and his staff agreed on the composition of 
the project team that will participate in the technical workshops, on deadlines for 
these workshops and on the deliverables. Figure 3 shows the model as developed 
during the second and third workshops. The model was then cleaned by the project 
leader and used to represent the project during the kick-off (March 2011). 

3.2 Technical Workshops 

The goal for the second series of workshops was to understand how to precisely relate the 
business requirements to the IT operations requirements, more precisely, the definition of 
the sequence in which the applications are to be resumed after the switch to the backup 
data center. We focused on the medical imaging service, which is considered to be one of 
the most complex services. The participants were mainly application managers and infra- 
structure managers. The manager of the psico project, the manager in charge of the 
backup center and the quality manager attended all workshops. 

Four half-day workshops were run between May and July 2011. Overall the work- 
shops lasted a total of approximately 12 hours with an average participation of 8 people. 

The result of the four workshops is a model consisting of 4 organizational levels of 
services: 

• FHVi and medical staff to implement services provided by FHV hospital, 

• IT infrastructure and applications to implement FHVi services, 

• Virtual machines and storage devices to implement IT infrastructure services, 

• Physical servers and OS to implement virtual machines services as well as 
network equipment to implement network services. 

The first three levels are the same as those used in the scoping workshops. The last 
one was introduced in the technical workshops. These four levels were modeled three 
times, one for each operation mode, i.e. normal, disconnected, psico. The psico model 
shows what needed to be developed for the psico mode. 
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Fig. 3. first technical workshop model (original workshop diagram). Part (a) describes the busi- 
ness processes and IT service. Part (b) describes the application and infrastructure services 
combined in IT processes. Part (c) describes the services provided by the storage infrastructure, 
it is a zoomed version of the bottom right model element in Part (b). Part (d) represents the 
implementation of the storage infrastructure. 

The first technical workshop was held with 10 participants, mostly IT infrastruc- 
ture people. We analyzed the sequence of transition between the normal, disconnected 
and reduced operation modes across the first three organizational levels. Figure 3 
illustrates this model. The part (a) of the diagram represents the service (ellipse in 
diagram) provided by FHVi to the doctors and how these services are combined in the 
business process (diamond in diagram). The color represents the modes (red = nor- 
mal, blue = disconnected and green = psico). In the diagram, (b) represents how the 
services are implemented by combining applications and infrastructures in processes. 
Part (c) of Figure 3 represents the services provided by the storage infrastructure, it is 
actually a detail of the lower right elements in (b). Part (d) represents the technical 
processes inside the storage infrastructure. 
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The second technical workshop was held with application managers and a few in- 
frastructure managers. During this meeting, we improved the models by better identi- 
fying the business roles of the service users. We also understood how the applications 
work together and the need to be able to access the medical and the administrative 
records in psico mode. We eventually added to the model, as a special kind of infra- 
structure, the middleware necessary to connect all these applications. 

The third technical workshop was organized with the infrastructure managers. We 
made explicit that two broad kinds of storage techniques are used: databases in virtual 
machines, and dedicated storage devices SAN or NAS. The way data migrates be- 
tween the main data center and the backup data center is done differently for each 
kind of storage technique. This leads to inconsistencies in the data after a switch to 
the backup data center. An architectural principle needs to be defined for the use of 
these storage techniques in a way that is compatible with the psico requirements. This 
also made us realize that the virtual machine strategy and the storage strategy could 
not be analyzed separately. This changed the structure of the SEAM models that were 
developed previously. The two separate systems: execution infrastructure and storage 
infrastructure had to be merged into one model element called storage and execution 
infrastructure. 







12h 24h Weeks or typ. 

max max months 8h - 

12h 



disaster 

Fig. 4. Diagram that illustrates the planned Recovery Time Objective 

The last technical workshop brought together the application managers and the in- 
frastructure managers for an overall review. We analyzed the time constraints related 
to the transition between operation modes: normal-disconnected, disconnected- 
reduced operation, reduced operation-normal. We made explicit that the levels of 
service was more complex than expected as shown in Figure 4. For example, the dis- 
connected mode will also be used in the transition back from the backup site to the 
main data center (when returning to normal). We identified that data can be lost for up 
to 12 hours before the disaster occurrence (Recovery Point Objective). We also con- 
firmed that the reduced mode of operation could last from several weeks to several 
months. This led us to decide that additional services (such computer assisted diag- 
nostics) should be added to the reduced operation mode - even if they were not 
explicitly present in the list of critical services. 
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Overall we developed and reviewed 9 diagrams as illustrated in Figure 5: recovery 
time objective, 3 diagrams of FHVi / doctor level (green = normal mode; yellow = 
psico mode; red = disconnected mode), 3 diagrams of application / infrastructure lev- 
el, 1 diagram of storage and infrastructure (3 modes combined), 1 diagram of 
physical servers and 1 diagram of network devices. 



Resultats: 

profile, 3 * metiers, 3 * IT, 1 * infra, 
1 * VM, 1 * reseau 
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Fig. 5. Bird’s eye view of the models developed during the workshops (original cleaned-up 
diagrams) 



We present in Figure 6 a simplified version of the models developed. It illustrates 
how SEAM models are built. This figure is drawn by hand because most models in 
the workshops were made by hand as well. This is important to give to the workshops 
participants the feeling that the diagrams capture work in progress. Otherwise, people 
tend to get locked in a “modeling stall” in a quest for the perfect model. 

The service systems are visible in two organizational levels. For example, FHVi+ is 
represented as a whole in FHV hospital and as a composite in the next level. When a 
system is represented as a whole, its name is followed by “[w]”, as composite by “[c]”. 
When represented as a whole, a service system provides a service to its beneficiaries. 
When represented as a composite, we can model how the service is implemented with a 
process. 
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In the models, we use color to show the different modes: green = Normal; yellow = 
Psico and Red = disconnected. We also added the letters “N”, “P”, “D” for readers 
who have black and white pictures. These modes correspond to different functionali- 
ties (or number of functions provided). In the developed models, the functionality is 
described by properties (represented as rectangles) associated to the service. In the 
model, some elements are marked with This indicates that this is an element to 
develop with the project. 

The first organizational level shows the business roles that benefits from the ser- 
vices provided by FHVi+. There is no difference visible between the three modes 
except that in the disconnected mode, paper has to be used for storing patient informa- 
tion instead of using the patient administrative management. In the real model, the 
details are visible (by showing the details of the services offered). 

The second organizational level shows how, within FHVi+, the service is imple- 
mented by combining applications and infrastructure. We can also notice the help 
desk, and the supplier (S) that provides the applications. We represent the suppliers, 
as they are instrumental in providing the applications (FHVi outsources the develop- 
ment of applications). The “+” after the service system name (e.g. “FHVi+”) reminds 
the workshop participants that the actors necessary to implement the service should be 
added to the system, even if they do not belong to the organization. 

The third organizational level shows how the storage and execution infrastructure 
provides its service. We represent databases, buildings, a supplier and a virtual ma- 
chine (VM) infrastructure. The buildings are marked “H” for hospital site, “M” for 
main site and “B” for backup site. There is a supplier that participates in the normal 
mode and the psico mode. In the normal mode, it acquires images for long-term im- 
age backup. In the psico mode, it provides access to the backup data and stores the 
new images generated. This illustrates that suppliers can be instrumental in providing 
a service and this is why they are visible in the diagram. 

The last organizational level represents the VM system service that includes 
physical machines, the OS and the site in which the machines are located. 

It is interesting to analyze how the concept of operation mode (normal, discon- 
nected, psico) appears in each organizational level. In the upper level, services are 
clearly differentiated depending on the operation mode and location information is 
visible. In the execution and storage, the different modes cannot be as clearly sepa- 
rated. The implementations of the different mode use the same kind of infrastructure; 
locations become important. For example, the database stored in the hospital is used 
in the three modes. In the virtual machine level, location of the equipment is critical. 
This illustrates one of the challenges of working in business and IT alignment. With- 
out understanding the evolution of the service offering between levels, it is very 
tempting to use implementation details to reference service levels. For example, be- 
fore doing the workshops, it was common for the IT people to speak about the “back- 
up site’’ when describing the service internally or to the business people. After the 
workshop, people talk about disconnected or psico mode. This is a better way to 
describe the service, as it is independent from the service implementation. 




Modeling an Emergency Service System for a Hospital Network 



83 





Fig. 6. Structure of the SEAM model (simplified) 

Once the models were developed, we had a wrap-up session to decide what needs to 
be done next. We decided that: (1) the models developed in the workshops will not be 
maintained and that the application documentation provided by the suppliers need to 
include some of this information, (2) an architecture group needs to be created to define 
the architectural principles for the IT systems. This group should issue a document that 
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would capture these principles and the structuring assumptions concerning the IT sys- 
tems. These assumptions are closely related to the way the SEAM model is structured 
(for example, merge of execution and storage infrastructure). The document will have an 
overview similar to Figure 6 (yet to be developed). 

4 Discussion 

This Section captures the findings and key learning points for the FHVi. They are 
broad enough to apply to any organization of similar scale. They are all based on the 
impact of a service view of the organization. 

4.1 Service Oriented Modeling to Focus on Delivery Rather than Structure 

It is always tempting in this kind of projects, to create models that follow organiza- 
tional boundaries and reporting structures in which the modelers represent the organi- 
zation as a suite of departments within departments. An important difference between 
a service model and an organizational model is the structuration as service systems as 
opposed to departments. A service system provides value to a stakeholder, which is 
outside the system. The beneficiary of what the department provides is less clearly 
identified and hence its value proposition is unclear. When we model service system, 
we have to include people, technology, suppliers, and any other resource necessary to 
implement the service within the system. Compare this with an organizational model, 
which usually doesn’t include suppliers because they are not formally part of the or- 
ganization. Also, in an organizational model, technology and people are often mod- 
eled separately and the department usually shows only the people because a 
department is related to a line of management. 

4.2 Service Oriented Analysis to Reduce Complexity 

Service models have several advantages: 

• They minimize the impact of the organizational structure. People are 
grouped by service provided and not by line of management. This improves 
team spirit. 

• The role of the suppliers is made highly visible. This is useful to make the 
organization and the supplier understand that the supplier is an instrumen- 
tal component of the service supply. 

• Potential conflicts of interests can be made visible. For example, a person 
might be inside a service system as provider of the service and outside the 
service system as beneficiary of the system. 

• By focusing on a specific service, the complexity of the model is reduced 
as we can represent only one service at a time. 

4.3 Service Oriented Analysis to Understand Architecture Requirements 

The initial question was “what in which sequence the services need to be resumed when 
switching from the main data center to the backup one”. After analysis, it appears that 
this sequence is important for the IT people but not really for the business people. It also 
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appeared that the people managing the virtual machines know how to resume the execu- 
tion in the backup data center. They work with logical groups of virtual machines that 
need to be started in a given sequence (for example, network related VM such as DHCP 
servers need to start first). What appeared clearly is that this strategy works only if some 
key architectural principles, such as a consistent management of the data storage between 
applications, are respected (and communicated to all relevant parties - such as the suppli- 
ers). This makes visible the architecture challenges requirements that the organization 
needs to comply with. 

The workshops also showed that one of the main challenges is the alignment 
between the applications and the IT infrastructure. IT infrastructure is evolving consi- 
derably with the new execution, storage and networking technologies. As a conse- 
quence. having an architecture that supports alignment between the applications and 
the infrastructure is key to guarantee the expected service levels. In the past, the 
alignment had to be made between business and IT. Now, it is between business and 
applications as well as between applications and infrastructure. 

The workshop also captured significant clarification of the curve related to 
Recovery Time Objective, which were not available prior to the project. These 
clarifications are also direct consequences of the architectural choices taken. 



5 Related Work 

SEAM belongs to the Enterprise Architecture family. A distinct property of all these 
methods is their representation of organizations in hierarchical levels. Zachman 
founded the Enterprise Architecture discipline in the late 1980s with the so-called 
Zachman Framework [18]. The Zachman Framework and Urba-EA [5] are Enterprise 
Architecture methods that are used predominantly to model the landscape of the IT in 
a given organization. More recent Enterprise Architecture frameworks, e.g. TOGAF 
[14] and ArchiMate [4], encompass more the notion of service. ArchiMate models 
organizations and services as a succession of external and internal views [4]. Value is 
captured in the external view and implementation in the internal view.. ArchiMate has 
three levels of analysis, the business layer. Application layer and Technology layer. 
The SEAM models we have developed in this project span all these three layers. Just 
like SEAM, ArchiMate uses a subset of UML. The business layer, in most Enterprise 
Architecture methods, does not have the concepts necessary to model the service 
strategy of the organization with its stakeholders. An effort is under way [1] to aug- 
ment ArchiMate with the Business Model Canvas [11] to fill this need. 

The concept of service system was recently introduced in Service Science, e.g. in 
[8 and 15], Early work in service system modeling is available in [6, 7 and 12], 

6 Conclusions and Future Work 

In this paper we presented an on-going ITSCM project at an IT department that serves 
a federation of hospitals in the southwest part of Switzerland. The project is aimed at 
defining the service levels that the IT can provide to the hospitals in the event of a 
major incident (e.g. fire or flood) and aligning these levels with an appropriate archi- 
tecture. We have shown the role played by service modeling with the SEAM 
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Enterprise Architecture method in the understanding of these service levels and the 
resulting IT architecture. Now that the service modeling is completed, this project 
continues with the aim of harmonizing all the applications so that the overall service 
provided by the backup site conforms to the service levels defined previously. 
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Abstract. The potential impact of new ICT on efforts to enhance citizen en- 
gagement in the policy process is now widely recognized, but the academic re- 
search on design, use and evaluation of e-engagement tools is still in its infancy. 
Through the use of an explorative case study, the aim of this paper is to consid- 
er how new ICT tools can be used to reinforce e-democracy and how the design 
of technology can facilitate citizen engagement. To this intent, we apply a new 
framework to evaluate the efficacy of some electronic tools used by a specific 
e-democracy project that involve, with different results, eight Italian Adminis- 
trations. We have assessed the level of e-democracy developments based on 
four different dimensions: transparency, interactivity, usability and web site 
maturity. 

Keywords: E-democracy, Transparency, Interactivity, Usability, Web Site 
Maturity . 



1 Introduction 

The impact of Information and Communication Technologies (ICT) on Public Ad- 
ministration has rapidly risen since governments worldwide embraced emerging tech- 
nologies as a mean to redesign and modernize archaic bureaucratic procedures [1], In 
recent times, in fact, the public sector’s conservative approach to ICT began to change 
and the organizational management started to recognize the benefits of putting into 
operation innovative technologies as an approach to change the traditional organiza- 
tion dimensions [2], In this perspective, the potential impact of new ICT on efforts to 
enhance citizen engagement in the policy process is now widely recognized. Re- 
searchers emphasize how Internet is particularly effective for establishing and main- 
taining the “weak” ties to sustain civic engagement [3, 4] and Scott [5] argues that 
municipal government Web sites clearly have the potential to enhance and inform 
local public -initiatives, whether online or conventional. 

However, enthusiastic ideas and projects often failed to produce the expected re- 
sults as technology is only the basis for new forms of organization and interaction. 
Some scholars are quite skeptical of the real potential of Web-based public involve- 
ment. Golding [6] and Wilhelm [7] suggest that Web sites will do little to overcome 
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limited participation among the disaffected, even if access to the Internet continues to 
increase. Others authors [8] argue that improved access to information will make 
governments more transparent, but if citizens are deficient in knowledge of or strong 
commitment to the political process, they will be overwhelmed by the quantity of 
information. Nie and Erbing [9] worry that heavy Internet use will reinforce social 
isolation and encumber civic involvement. Chadwick and May [10] conclude that e- 
governance initiatives in the United States, Britain and Europe have thus far generally 
reinforced managerialism and do little to open important opportunities for citizens to 
participate in public debate. Governments need to adapt structures and decision- 
making processes to ensure that the results of online consultations are analyzed, 
disseminated and used. Given the special nature of public choice and the special prob- 
lems that arise in Public Administration, adequate decision requires that public organ- 
izations and citizens create a particular model of shared decision making - one that we 
refer to as inclusive decision making. 

Despite the fundamental role that ICT plays in this process, the academic re- 
search on design, use and evaluation of e-engagement tools is still in its infancy. 
Through the use of an explorative case study, the overall aim of this paper is to 
consider how new ICT tools can be used to reinforce representative democracy and 
how the design of technology can facilitate citizen engagement. To this intent, we 
apply a new framework to evaluate the efficacy of some electronic tools used by a 
specific e-government project that involve, with different results, eight Italian Ad- 
ministrations. In particular, our analysis is focused on the DE.CI.DI. Project case, 
that aims at promoting e-democracy at a Provincial Administration level. The 
project involves eight Italian provinces (Genoa, Alessandria, Ascoli-Piceno, La 
Spezia, Lecce, Pesaro-Urbino, Piacenza and Savona) governing a total of 3.5 mil- 
lion citizens. 

The paper is organized as follows: after an introduction to relevant concepts and li- 
terature (Section 2), Section 3 introduces the case and the methods used. Section 4 
provides an evaluation of the e-democracy process. On the basis of this analysis, some 
critical reflections are offered in Section 5. 



2 Literature Review 

The origin of theoretical standings which are at the basis of public participation in the 
decision making processes of Public Administrations can be traced back to the period 
falling between the Sixties and Seventies. In that decade, there was a tendency to 
improve the democratization and legitimacy of public policy [11] through participa- 
tion, particularly for the decisions regarding the local policies involving all stakehold- 
ers. These stakeholders may be defined as “organizations and individuals whose 
interests are affected by the policy under discussion” [12]. The definition, in other 
terms, also includes common citizens, that is to say, those “not holding office or ad- 
ministrative positions in government” [13]. 

In the last decade, a growing number of contributions [ 14, 15, 16] have repurposed 
the theoretical debate concerning the participation of stakeholders in public decisions 
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introducing the concept of deliberative democracy [17]. The term refers to the deci- 
sion-making process which is characterized by two peculiar aspects: the deliberative 
aspect and democratic aspect (or inclusive one). 

The aspect of deliberation refers to the fact that the decision-making process is 
founded on impartial judgments based on common welfare. In other terms, in the 
above mentioned context, “deliberation” recalls the argumentative process through 
which decisions are taken, rather than the final outcome through which the deci- 
sion becomes a formal act. On the other hand, the democratic aspect of the 
process, is given by the fact that there is a form of participation, at a level of 
equality, of the representatives of all the parties involved in the consequences of 
that same decision [15, 18]. 

The condition that makes the deliberation a democratic one, involves the participa- 
tion of all the parties concerned in the outcome of the deliberation itself. The ques- 
tion is then how to include the opinion of ordinary citizens and support the local 
policy decision making process. To capture the meanings that various authors have 
given to the concept of deliberative democracy we can compare three different types 
of democratic theory: representative, pluralist and direct democracy. According to 
Delli Carpini et. al [19], representative theory focuses on the operation of the demo- 
cratic political system as a whole and is grounded in the facts of present-day political 
attitudes and behavior as revealed by sociological investigation. In the theory, “de- 
mocracy” refers to a political method or set of institutional arrangements at a national 
level. The characteristically democratic element in the method is the competition of 
leaders (elites) for votes of the people at periodic, free elections. “Political equality” 
in the theory refers to universal suffrage and to the existence of equality of opportuni- 
ty of access to channels of influence over leaders. Finally, “participation”, so far as 
the majority is concerned, is participation in the choice of decision-makers [20]. 

Direct democracy theory - sometimes referred to as deliberative democracy [21] or 
strong democracy [22] - sees periodic elections as necessary but insufficient for con- 
temporary democracy. So, it is based on the normative assumption that citizens should 
have equal opportunities to participate in the making of major political decisions and 
that participants should have equal influence over the outcome of this process. 

Technology brings a new element into this conceptual field. From a representative 
perspective ICT can improve representation by helping citizens to evaluate the 
records of governments and elected official and by providing way for citizens to inte- 
ract directly with officials. For Pluralist theorists ICT reduce the cost of information 
and facilitate the multiplication of interest groups. Finally, for Direct Democracy 
theorists ICT can reengage citizens that are dissatisfied and detached. E-democracy 
can overcome space and time constraints on public involvement. 

In other words, developments in ICT, and particularly the increasing spreading of 
Internet, suggest that ICT could be used to widen the spectrum of participants in poli- 
cy making process [23]. Holden describes the evolution of integrated networks as a 
series of three stages. Public managers first began utilizing information technologies 
in the 1960s with the Management of Information System (MIS), which focused on 
automation and efficiency. In the 1970s, the Information Resource Management 
(IRM) became the first technology, typified by accessibility and integration. In this 
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decade, citizens would be linking to computers to get free public information. But 
these visions were viewed utopian; with few people believed that widespread citizen 
access to computers was plausible [24], Since the 1990s, information and communica- 
tion technologies contribute to the emergence of a different type of democratic gover- 
nance, i.e. democratic e-Governance [24, 25]. The concept of democratic e- 
Governance can be used as an umbrella concept that combines three different pers- 
pectives about the utilization of ICT in government’s policies: 

• the first point of view is named e-Government. It is about all political- 
administrative operations of governments in which ICT are utilized; 

• the second point of view is named e-Governance. It is about managing and 
routing multi-sector stakeholder relations with the help of ICT. The purpose 
is that of taking care of policy, service and development functions of gov- 
ernment; 

• the last is named e-Democracy. The concept refers to democratic structures 
and processes in which ICT are utilized. In other words, e-Democracy com- 
bines two fundamental elements, technological mediation tools and institu- 
tional arrangements that can be said to be democratic [25]. 

By combining these three perspectives we can say that one important factor, which 
characterizes democratic e-Governance, is the participation of the citizens in digital 
democracy initiatives. This is accomplished by engaging in online discussion forums 
and participating in inclusive decision process in order to share a basis of understanding 
as common ground from which to mediate consensus [26]. Different approaches have 
been proposed in the field of e-democracy. Gross proposes to build public-life informa- 
tion systems based on widespread Internet services [25], such as email, newsgroups, and 
the WWW. Shires and Craig recognize the limitation of a unidirectional flow of infor- 
mation from governments to individuals and propose an application, called Minutes-n- 
Motion, which allows citizens to define customized view of the public-life information 
[22]. Watson and Mundy [8] propose a three-phase, dual-pronged strategy for imple- 
menting e-democracy. The three phases are: initiation, infusion and customization. The 
first phase, initiation, providing citizens with a single point of access to government 
information and Web-enabling government payments are the critical initial goals. In the 
second phase, infusion, online review and payment applications are widely installed. 
Citizens can make most government payment via the Web and electronic bill present- 
ment is the standard. On the effectiveness side, political decision-making becomes in- 
creasingly transparent. Citizens can drill into the process and discover how a particular 
piece of legislation is being modeled. In the last phase, customization, e-democracy 
implements a one-to one relationship between citizen and government. 

With regard to the access to public-life information. Doctor and Ankem [27] pro- 
pose an interesting system taxonomy based on three dimensions. The first dimension 
concerns the subject of the information (e.g., government, education, social services, 
etc.); the second dimension distinguishes the type of provided help (e.g., interactive, 
informational, advice, etc.), while the last dimension is related to socio-economical 
identifiers of accessing people (e.g., age, gender, education, income, etc.). 

Within e-democracy initiatives, it is common to distinguish between two areas: one 
addressing e-voting and the other addressing e-engagement or e-participation [28]. 
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Despite the manifest interest in e-voting, in the second part of this paper, we will be 
focusing our attention on e-participation. Scholars who are interested in e-democracy 
define e-participation in varying terms. For example, some scholars use the word e- 
participation to refer to the use of ICT in supporting the information, consultation and 
participation of citizens. In other words, they argue that the entire public participation 
process may be considered as a global collaborative writing process where anonym- 
ous citizens try to draw up, not one, but as many documents are necessary to express 
their different point of view. 

3 Research Methodology 

In order to build a framework that can help to evaluate the design and the implemen- 
tation of the e-democacy projects, we perform an in-depth case study [29]. We ana- 
lyzed the web sites of the Italian regional governments who have agreed to take part 
in the De.Ci.Di. project which aims to try e-democracy in Public Administrations. 
The De.Ci.Di. project aims to promote and increase the participation of citizens in 
public decisions. 

According to the literature presented above, we build our framework to evaluate 
the level of e-democracy developments, based on four different dimensions: transpa- 
rency, interactivity, usability and web site maturity. 

In order to evaluate the features related to transparency and interactivity, we adopt 
the Web Site Attribute Evaluation System (WAES) methodology developed by the 
Cyberspace Policy Research Group [30]. In order to evaluate the features related to 
usability and web site we adopt the items introduced by Pina, Torres and Royo [20] 
(see table 1). Transparency on web sites refers to the extent to which an organization 
makes information about internal works, decision processes and procedures available. 
Interactivity is a measure of the level of convenience, degree of immediate feedback 
and development of interactive e-services. Usability refers to the ease with which 
users can access information and navigate the web portal [2]. The features included in 
this section are multiple language access for visitors unable to speak or read the lan- 
guage of the host country; glossaries of technical or difficult term; a ‘what’s new’ 
section, a sitemap, an A to Z index, a FAQs section, search engines, specialized data- 
bases and a uniform layout. Web site maturity embraces those aspects that indicate a 
high degree of web site sophistication: no broken links, the provision of audio or vid- 
eo files, content arranged according to life events/business episodes, credit card pay- 
ments, use of digital signatures for transactions, live broadcast of important speeches 
or events, and the use of the web site for some kind of citizen consultation [20]. 

The indicators of transparency may be grouped into five categories: 1) ownership 
(level of commitment shown by the government, through its agencies, in management 
and internet site-building capabilities: the government can hand over web-site man- 
agement tasks to internal or external agencies and, in that, it is reducing transparency; 
2) contacts and reachability (the level of reachability of the government); 3) organiza- 
tional information (the quantity and selection of information concerning the organiza- 
tion and the structure of government which is available to the website owner; 4) issue 
information (the presence of information concerning the campaigns conducted by the 
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government within the website); 5) citizen consequences and responses (if and to 
what extent, a citizen is required to provide indications and responses or undertake 
actions; what can be done with the information provided by the website). 

The indicators of interactivity may also be grouped into five categories: 1) security 
and privacy (the more the website is accessible, the less the visiting citizen is com- 
pelled to provide personal information in order to download data from the website or 
to upload it); 2) contact and reachability (to what extent does the organization and 
structure of the website explicitly allow a specific person to write, for example its 
own representatives; 3) organizational information (the possibility to directly contact 
those found in government structure and organization); 4) issue information (the 
possibility for the citizen who is visiting the website to attain information on how 
government is handling the policies regarding the context; it may be a personalized 
response that the citizen can receive from the site; 5) citizen consequences and res- 
ponses (how easy is it for the citizen, visiting the website, to track the efforts of the 
organization through the use of technical support that available). 

The interaction between these two dimensions, transparency and interactivity, re- 
flect the institution’s degree of openness [30]. 

Table 1. Table of dimensions 



Transparency 


Interactivity 


Ownership 


Security and privacy 


Contacts and reachability 


Contact and reachability 


Organizational information 


Organizational information 


Issue information 


Issue information 


Citizen consequences and responses 


Citizen consequences and responses 


Usability 


Web site maturity 


Languages 


No broken links 


Glossary 


Audio/video files 


What's new section 


Life events or business episodes 


Sitemap 


Digital signatures 


A-Z index 


Live broadcast of speeches/ events 


FAQ 


Citizen consultation 


Search Engine 




Databases 




Homogeneity of different subpages 




Text only or accessible version 




Audio access for visually impaired 
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The scores shown in table 2 and in table 3, show the value zero when the item ana- 
lyzed doesn’t appear on the web site and the value 1 when the items analyzed appear 
on the web site. The global scores in transparency, interactivity, usability and web site 
maturity have been obtained by adding up the individual scores for every relevant 
item in each dimension. 



4 The De.Ci.Di. Project: Evaluation of the E-Democracy 
Process 

The De.Ci.Di. Project (acronym for Democrazia per la Cittadinanza Digitate - De- 
mocracy for Digital Citizenship) aims at implementing e-democracy at a Provincial 
Administration level. The project, coordinated by the Province of Genoa, groups sev- 
en other provinces (Alessandria, Ascoli-Piceno, La Spezia, Lecce, Pesaro-Urbino, 
Piacenza e Savona) governing a total population of 3.5 million citizens. The project 
was initiated in 2006 to promote the participation of citizens in the decision-making 
process of Public Administrations, through the use of 1CT. 

In the development phase, De.Ci.Di. lay down a number of strategic objectives. 
Firstly, the implementation of ICT tools to promote social integration and the analysis 
of the decision making process. Secondly, the development of a flexible system capa- 
ble of questioning the public and its choices in order to stimulate active participation 
via internet to public life, with an emphasis on the expression of indications and sug- 
gestions concerning public expenditure. 

The tool chosen for the investigation was the “informed research”, that allows the 
direct participation of the citizen through the expression of a double view point or 
opinion of the target groups, chosen on the basis of statistical criteria. At first, the 
participants expressed their view point on a specific matter without receiving any 
additional and precise information about the topic under enquiry; at a latter phase, the 
same target group of citizens was again required to express their opinion on the same 
matter after having received detailed information concerning other groups who had a 
completely different view point concerning the matter under enquiry/discussion. The 
website dedicated to the project (www.decidi.it) has been developed to support this 
collaborative writing model to public participation. It allows citizens to ask questions 
to relevant official entities and to browse through the documents essential to forming 
an informed opinion. 

The information provided to the citizens is not managed exclusively by an institu- 
tional body, or the administration that is meant to take the decision, but also by other 
subjects who have a different position or interest in the matter. 

Since October 2006, citizens may access the website either as “guests” or as full 
registered participants. “Guests” may only view the information but cannot really 
participate. In order to become full registered participants, the citizens could subscribe 
to the website dedicated to the project indicating their personal data and their personal 
ID number. The main purpose of registration is to allow traceability between contri- 
butions and authors, which is fundamental to conducting the collaborative authoring 
process and to the endorsement mechanism. In any case, all contributions will be 
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presented publicly, without any reference to their authors. The subscription allowed 
citizens to access the website environment pages, which were subdivided as follows: a 
detailed questionnaire (generally made up of multiple choice questions), which asked 
citizens about a specific matter; informative material and the position of participating 
associations holding different opinions and interests; a forum, where users interacted 
and made comments about the documentation which had been made available, A wide 
variety of topics were taken into consideration and each province had the opportunity 
to choose its own depending on ongoing activities or strategies that had already been 
implemented. Normally, the choice fell on topics which had a direct impact on citi- 
zenship: the environment, employment and security measures: culture and integration; 
tourism; youth and schools etc.. 

A second phase of the De.Ci.Di. project, began in 2008, still receives the important 
contribution of two partners who guarantee a functional and scientific validity to the 
participation process as a whole: Microsoft Italia and the Department of Mathematics 
of the University of Genoa. The role Microsoft Italia is that of providing complete 
support for the planning and development of the architectural structure of the technol- 
ogy used which is necessary in order to guarantee an effective and valuable participa- 
tion of citizens. 

The Department of Mathematics of the University of Genoa, on the other hand, de- 
fines the methodology for the statistical findings and the accreditation of opinions as 
to provide to the project, the truthfulness and full legitimacy of citizen viewpoints 
which are to be the expression of a true representation and share of the population of 
those local governmental bodies participating in the project. 

From the case description, it is clear that the De.Ci.Di. project has introduced sig- 
nificant modification to the relation between the Public Administrations involved and 
its citizens. The case of De.Ci.Di. demonstrates how a Public Administration unleash- 
es the capabilities of Internet to craft a robust e-democracy architecture that acts as a 
common denominator between the public administrator and the citizens. 

To evaluate the efficacy of the tools used, we apply our framework to the analy- 
sis of the project results. All the eight provinces involved, agreed to participate in 
the De.Ci.Di. project allows to obtain key information about the transparency and 
interactivity of the provinces under enquiry and thus the true opportunities offered 
to the citizens participating in public decision making. From a first examination of 
sites the level maturity of websites is immediately noticeable. The analysis of the 
websites of the eight Public Administrations are presented. The websites of the 
provinces of Alessandria, Ascoli-Piceno, Lecce and Savona contain a list of topics 
that will be subject to voting by citizens, but are lacking, at least at this phase, of 
informative documentation about the topics dealt with. Furthermore, in the provinc- 
es of Lecce, Alessandria and Piacenza, no contact person is mentioned within the 
website to whom the citizen can refer to in order to obtain information about the 
project. The situation is slightly different in the websites of provinces of Pesaro- 
Urbino. In these websites, besides the listing of the topics subject to public opinion, 
(Choices for the future, Youths and Europe; participation and communication; Tak- 
ing action for the young), detailed informative material relating to the themes is 
available and accessible. 
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Table 2. The Transparency: Web site scores 



Items 


Transparency Score: 


Genoa 


Pesaro 

LaSpezia 

Piacenza 


Alessandria 

Ascoli, 

Lecce, 

Savona 


Ownership 
/Security and 


Tla Agency involvement with site 
Tib Webmaster appears to be different 


1 


1 


1 


Privacy (In- 
teractivity) 


from the one running the government page 
Tic Provides obvious tailoring indicating 


1 


0 


0 




agency itself has ownership of site content 


0 


0 


0 




Tld provides published date 


0 


1 


0 


Contacts 


T2a Provides central agency non-email 
addresses 


0 


0 


0 




T2b Provides phone numbers or postal 
addresses for employees within agency 
beyond most senior officials 
T2c Provides e-mail address to responsible 


1 


1 


0 




for content and technical support 

T2d Provides e-mail address to someone 


0 


1 


0 




solely responsible for technical support 


0 


0 


0 


Organiza- 
tional infor- 
mation 


T3a Provides details on senior official’s 
experiences or vision of future for institute 
T3b Provides mission statement and vari- 


0 


0 


0 




ous activities of agency 

T3c Provides organizational structure in 


1 


0 


0 




graphic form 


0 


0 


0 


Issue infor- 
mation 


T4a Provides issue-related addresses for 
other government agencies 


1 


1 


0 




T4b Provides non-issue-related addresses 

for other government agencies 

T4c Provides issue-related addresses for 


1 


0 


0 




other NON-government information 
sources 

T4d Provides a searchable index for ar- 


1 


0 


0 




chived newsletters, laws, regulations, and 
requirements 


0 


0 


0 




T4e provides link to or text of public in- 
formation law or regulation 


0 


0 


0 


Responses/ 
Citizen con- 
sequences 
(Interactivity) 


T5a Provides in depth explanations of 
requirements imposed on citizens resulting 
T5b Provides instructions for appeal proc- 
ess for decisions or address of an ombuds- 


1 


0 


0 




man inside agency 


1 


0 


0 


Total scores 


Transparency 


9/18 


5/18 


1/18 
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Table 3. Interactivity: Web site scores 



Items 


Interactivity 


Genoa 


Pesaro 
La Spezia 
Piacenza 


Alessan 

dria, 

Ascoli, 

Lecce, 

Savona 


Ownership 
/Security and 
Privacy (Inter- 


Ila Does NOT require personal informa- 
tion (beyond return e-mail address) to 
communicate with agency 


1 


1 


1 


activity) 


I lb Security access method, such as 
password or secure server use, is associ- 
ated with transaction with agency or 
access to personal information 


1 


1 


1 


Contacts 


I2a Provides e-mail link to webmaster 


0 


0 


0 




I2b Provides e-mail link to senior agency 
official 


1 


1 


0 




I2c Provides e-mail link to a number of 
agency employees 


1 


1 


0 




I2d Provides an online issue-related fo- 
rum for outsider participation such as chat 
lines, and list serves 


1 


0 


0 


Organizational 

information 


I3a Provides link to listed sub-elements 
within agency 

I3b Provides automatic update an- 
nouncement or newsletter via subscrip- 


0 


0 


0 




tion 


0 


0 


0 


Issue informa- 
tion 


I4a provides link to outside issue-related 
government addresses 


1 


0 


0 




I4b provides link to outside non-issue- 
related government addresses 


1 


0 


0 




I4c provides link to outside issue-related 
non-govemment information sources 


1 


0-1 


0 


Responses/ 
Citizen conse- 
quences (Inter- 


I5a Provides link to regulation informa- 
tion 

I5b Provides online form completion and 


1 


0 


0 


activity) 


submission 

I5c Provides link to appeal process for 

decisions and/or an ombudsman 

I5d Provides other language access to site 


1 


1 


0-1 




for visitors unable to speak or read the 
language of the host country 


0 


0 


0 




I5e Provides iconographic access to site 
for visitors 


1 


0 


0 


Tot scores 


Interactivity 


11/15 


5-6/15 


2-3/15 



As highlighted by the synoptic tables 2 and 3, the items which showed the best 
results in both dimensions (transparency and interactivity) are those referring to Own- 
ership and Security as well as Privacy; Issue Information, Responses and Citizen con- 
sequences. The dimension that showed the worst results is that referring, once again. 
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the two dimensions, of “organization and information”. As for transparency, the low- 
est score may be assigned to the eleventh item “contacts”. From the overall analysis 
of the table it is clear that the De.Ci.Di. project is to be considered a good example of 
e-democracy, even though wide areas of improvement still exist, particularly in refer- 
ence to transparency. Another finding to be highlighted is that only the web site of 
Genoa show clear sign of openness. Openness is made up of two components: trans- 
parency and interactivity. Citizens would not be able to hold their government deci- 
sions and they had no channel for interact [20], 

As can be seen from table 4, similar results can be found in the usability and web 
maturity dimensions that we present only for the Genoa’s website, since the website 
of province of Genoa is the only one reporting a quantity of information which allows 
for its evaluation in terms of usability and web site accessibility. 

Usability shows a good degree of development in technical items such as search 
engine and homogeneity of sub-pages, but a worst development in those items which 
are able to enhance the accessibility of web sites and to bring about social inclusion, 
such as audio access for the visually impaired; different languages or compliance with 
international accessibility standards; glossary of technical or difficult terms; A-Z in- 
dex. Likewise, the group of “web maturity”, which contains items related to innova- 
tion, such as the digital signature and live broadcast of speeches or events, shows the 
value zero. 



Table 4. Usability and web site maturity: web site scores by Genoa 



Items 


Usability 


Score 


Web site maturity 


Score 




U1 - Languages 


0 


W1 - No broken links 


1 




U2 - Glossary 


0 


W2 - Audio/video files 


1 




U3 - What’s new section 


1 


W3 - Life events or business 


1 




U4 - Sitemap 


1 


episodes 






U5 - A-Z index 


0 


W4 - Digital signatures 


0 




U6 - FAQ 


1 


W5 - Live broadcast of 


1 




U7 - Search Engine 


1 


speeches/ events 






U8 - Databases 


0 


W6 - Citizen consultation 


1 




U9 - Homogeneity of different 


1 








subpages 










U10 - Text only or accessible 


0 








version 










U 1 1 - Audio access for visually 


0 








impaired 








Total 




5/11 




5/6 


Scores 
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5 Limitations and Conclusion 

The aim of this paper is to consider how new ICT tools can be used to reinforce 
representative democracy and how the design of technology can facilitate citizen 
engagement. To this intent, we apply a new framework to evaluate the efficacy of 
some electronic tools used by a specific e-government project, the DE.CI.DI. 
Project. As we have characterized it, inclusive decision processes imposes the iden- 
tification of critical stakeholders and for this reason it may not be an appropriate 
model for all kinds of problems. Additionally, this paper highlights the importance 
of citizen participation (e-participation) to inform such initiatives and to measure 
citizen perspectives on the development and deployment of e-democracy. 

However, as we have explained, there are several important distinguishing types of 
problems that strongly suggest that public administrators and citizens in this context 
should strive to realize this model of inclusive decision making. 

In emphasizing e-democracy, we have not meant to deny the importance of other 
efforts to respond to the problem of inadequate participation of citizens to the public 
decisions. 

E-democracy has enormous potential to encourage a more direct citizen engage- 
ment and to change in the area of public decision making but those expectations have 
not been fully met yet. In order to increase the contributions of web sites in order to 
raise the number of inclusive decision processes, governments and policy-makers 
would do well to reinforce the transparency, the interactivity, the usability and the 
web site maturity of their web sites. 

The findings and the proposed framework in this study may also bear important 
managerial implications. In fact, it can be gathered that e-participation is an essential 
step in changing the often rigid and uncompetitive nature of bureaucratic Public Ad- 
ministrations by revolutionizing the relationships between the organization and its 
citizens. Moreover, the competitive boundary to be obtained from any e-participation 
strategy is intricately tied to the degree of connectivity between the organization and 
its citizens. Additionally, Public Administrations can use our framework, even, to 
review the completeness of their Web Site and determine which functionalities need 
to be added to their site to enhance e-democracy and e-participation. 

The findings of our research suffer from the usual limitations of interpretive case 
studies, in terms of generalization. As with any empirical investigation, weakness in 
the methodology and data will be present, and this study is no different. Two limita- 
tions, in particular, should be mentioned. 

Firstly, the data used in this study were collected exclusively from web site of Pub- 
lic Administrations operating in Italy. Secondly, the sample of case study doesn’t 
provide a complete and extensive survey on the Italian enhancement toward e- 
democracy but focuses on eight provinces in Italy. Nevertheless, as clarified by Yin 
[29], the generalizing properties of a case differ from quantitative studies because 
survey research relies on statistical generalization, whereas case study rely on analyti- 
cal generalization. In analytical generalization, the investigator is “striving to general- 
ize a particular set of results to some broader theory’’ [39, p. 36]. Taken in this light, 
our analysis could provide a vocabulary that researchers and practitioners could em- 
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ploy in the identification of similar components in other Public Administrations, so 
that future project to the enhancement of e-democracy can be compared and ben- 
chmarked. 

For future studies on the subject, we identify one specific area of research that may 
effectively enhance our comprehension of e-participation projects. Studies of a similar 
nature, as recommended by Yin (1994), should be replicated to affirm the findings 
and validate our proposed theory. Finally, it is important for subsequent studies to 
understand that municipal governments are not the only actors that can facilitate civic 
engagement through web site services. As we investigate the role of local govern- 
ments in facilitating deliberation and participation in local public issues, it is impor- 
tant to monitor and debate the complementary functions that these and other actors 
may play in the process. 
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Abstract. Protection of data and information security are crucial to business 
processes and include technical, sociological and organizational aspects. The 
purpose of this paper is to explore the importance of information security policy 
and organizational compliance within a socio-technical framework. Citing come 
of the major compliance acts in the United States, this paper examines how the 
need arose for information security compliance and the antecedents that made 
compliance mandatory for organizations. This would apply to any organization, 
in whichever other country, within its legal compliance framework. A discus- 
sion follows to help shed light on how both individual employees and the 
organization as a whole often fail to implement a satisfactory compliance initia- 
tive. Finally, the research presents a set of key factors that influence successful 
implementation of information system security Compliance into the information 
security policy (ISP), along with what actions should be taken to make com- 
pliance a competitive advantage for the organization, taking advantage of the 
particular relationship between compliance and ISP. 



Keywords: Compliance, information security policy, ISP, information systems 
security, ISS. 



1 Introduction 

Organizations continually experience losses, financial and otherwise, due to non- 
complaint behavior [1], Executing leadership in agreement with IT security policy 
and compliance is emerging as a challenge as manager must balance the task of moti- 
vating employees to compliance without mandating it counter-productive punishment 
for non-compliant behavior [2], Compliance in an organization is part of the policy 
component and ultimately can be an integral part of the competitive advantage 
enjoyed by the company [3-5]. Information systems security (hereafter ISS) is an 
essential feature in most organizations today and compliance is one method to gain 
visibility to processes and controls that ensure digital security, and the organizational 
aspect of it is explicit in the information security policy (ISP). The purpose of this 
paper is to discuss the importance of ISP and compliance using a socio-technical 
framework [6-7], Citing common compliance behaviors, the origins of compliance are 
discussed followed by a discussion of how individual employees and the organization 
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as a whole contribute to compliance failure [8]. The present research presents as dis- 
cussion a set of key factors that influence successful implementation of information 
security compliance into ISP, along with the identification of what actions are neces- 
sary to ensure compliance, appropriate ISP and sustained competitive advantage for 
the organization. 



2 Objectives and Scope 

Compliance is a conceptual area, which focuses on satisfying the requirement of vari- 
ous laws and regulations (at a global level), mandates and policy frameworks (at lo- 
cal). Most of these mandates have also the intent of improving security, including 
information security. Compliance has a variety of definitions, all pertaining to regula- 
tory and prescription, also addressing audit matters in order to assess the implementa- 
tion of those regulations; i.e. “[is] either a state of being in accordance with 
established guidelines, specifications, or legislation or the process of becoming so” 
[9]. Primly those regulations and prescriptions come from legislation (i.e. SOX, 
HIPAA, GLB et altrii ), and only secondarily from best practices [10-11]; only at the 
latter level there can be organization’s own specific guidelines derived from internal 
practices or experience, while legal rules are not negotiable. An important point is to 
assure that legislation is ahead and keeping up with best practices. 

Within the organization the information security policy (hereafter ISP) is the major 
source of regulation. As the result from the exogenous drive, organizations create 
ISPs to provide employees with guidelines [12], 

In terms of impact the organizational relationship between Compliance rules (ex- 
ogenous) and ISP (endogenous) can be observed as a threefold: IT operations, 
Security and Audit [13]. 

One question would be: how would the ISPs be if there were no Compliance acts? 
It is clear enough that in many cases there wouldn’t even be an ISP either [ 14-15], 
Keeping the importance of information security and its relevance in today’s mar- 
kets and market space in mind, this paper aims to define the key success factor in the 
implementation of information security compliance on an organization’s existing 
information security policy. In the attempt to answer hidden and non-salient facets of 
compliance and ISP [16], a series of four relevant questions, propositions, and issues 
guide the remainder of the discussion: 

1 . How did compliance emerge as an essential component of ISP and what best prac- 
tices do organizations followed to ensure secure information systems? What major 
polices are currently in place to adhere to compliance rules? 

2. What are the reasons behind organizations constantly infusing money into their 
compliance budgets? What advantages are realized from this infusion? 

3. What are the factors that lead to ignorance of compliance policies within organiza- 
tions both from employees’ and the managers' points of view? 

4. What standardized framework of how companies should approach compliance can 
organization's implement to maximize benefits and minimize risks and costs of 
compliance/non-compliance? 
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Fig. 1 . Research steps 



Regardless of where an organization is on the compliance/non-compliance spec- 
trum [17], the framework discussed in this paper has the potential to reveal those 
cracks through which the important aspects of compliance fall, the nature of non- 
compliant employees [8], and those aspects that jeopardize security and, ultimately, 
competitive advantage [18-20]. The revelation of those aspects can help managers put 
employees and the organization on a track to universal compliance and a more 
desirable state of systems security [21]. 

From a socio-technical standpoint, some aspects that are necessary for compliance 
include workplace culture, attitudes/behaviors of employees [6, 22], and shortcomings 
in the planning process that naturally lead to non-compliance and a more vulnerable 
information system [23-25]. The paper examines the subtle differences that exist be- 
tween the actual and the expected, and suggests measures to overcome a faulty com- 
pliance plan. This information can be used by any sector or organization as a guide to 
secure its assets, information, and business operations from digital threats [26]. 



3 Information System Security and Compliance 

ISS is the name given to all processes and activities aimed at protecting information 
from tampering, corruption, theft, and/or unauthorized use or access [27], The prime 
objective of ISS is to securely make information available to its intended users [28]. 

3.1 ISS 

In recent decades, electronic means of communication, data sharing, and dissemination 
of electronic information has gained considerable momentum. Private and potentially 
sensitive information is transmitted with lightening speed across both private and public 
networks inviting the possibility of information theft, leakage, and unauthorized access to 
information centers. In the early information system years, it was believed that self- 
sufficiency and adhering to the best practices in ISS would suffice for information pro- 
tection [23, 29]. Over time, information sensitive sectors like healthcare, finance, and 
education developed policies to provide a systematic approach to the ISS process 
[30-31], 
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However, increased security breaches during the last decade forced regulators to 
realize that conventional methods of securing digital information may no longer be 
applicable, which initiated the need for successful compliance programs that are 
proactive in avoiding the risks of security breaches [32], which are showing a grow- 
ing rate of presence [33-35]. Consequently, an organization's overall security strategy 
must integrate a sound compliance program that covers all departments and depart- 
mental activities [36]. Decentralized approaches have been difficult to implement and 
monitor [37], thus the need for a unified approach where information trickles down to 
various levels of the organization that is easy to monitor and whose benefits are 
quantifiable right from the beginning of implementation [38-39]. 

3.2 Security Compliance Dimensions 

The biggest obstacle of security compliance is the maintenance of secure environ- 
ments and the protection of valuable and sensitive data such as credit card informa- 
tion, health records, and student records, the loss of which could result in financial, 
legal, moral, and other risks [40-41 ]. 

Siponen suggests that about compliance, irrespective of the level of information 
systems security, the following questions are most salient [29]: 

• How should information be protected from unauthorized access in a completely 
virtual environment? 

• How can it be ensured that administrative responsibilities are adhering to the 
compliance norms? 

• How will systems that are isolated from one other share the same information? 

Reviewing past and widely accepted activities when it comes to ISS, the following are 
the best practices that serve to protect both virtual information and the physical 
systems that deliver that information. 

— Platform hardening. Platform hardening is the name given to proper management 
of both the infrastructure and administrative layers of an information system [42], 
It reduces risk of unauthorized access to a network and is comprised of virtual 
switches, computer hardware, and other systems. Platform hardening also includes 
deployment of the latest software patches and configuration of networks with the 
latest and securest settings . 

— Change and configuration management. IT administrators spend a significant 
amount of time upgrading virtual networks to new standards and profiles [43]. 
During such upgrades, it is necessary that systems changes and configurations are 
extended when needed [44], In organizations using rich data, it is often unknown 
specifically who is using the data and from where the data are being accessed. In 
addition, it is understood that the data is available to many, rather than a single per- 
son [45]. In implementing change management, it is essential to be vigilant when 
applying security techniques, resources, and infrastructure to not only implement 
changes quickly but to implement the right changes so those accessing the data can 
do so quickly, efficiently, and without any major interruptions in service. 
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— Access control on administrative duties. Another important practice to be observed 
is the clear segregation and maintenance of administrative duties, roles, and re- 
sponsibilities to ensure that none of the management executives or administrators 
are in a position to take advantage of access to sensitive or confidential information 
[46]. Access controls enhance the effects of the fiduciary responsibilities of admin- 
istrators to protect not only the data but also the administrators themselves from 
accusations [47], 

— Segmentation and security of network. Securing a network though segmentation, 
can be achieved by extending and replicating the physical systems and infrastruc- 
ture since, ultimately, it is the computers themselves that store information [48]. 
Compliance is followed when computers are separate from each other, leaving no 
scope of information being stored or passing through a machine where it is not 
needed ([49-50], 

— Audit logging. An audit log is a database and record of the activities and processes 
that have taken place on virtual system. It often happens that leakage of informa- 
tion occurs after a user exits the system and another person maliciously retrieves 
the information stored in the logs [51-52], Thus, there must be proper provision of 
monitoring and tracking of the logs and their storage destination. Moreover, ad- 
ministrators should be mandated to report their actions on safe handling of logs 
[53], 

From the exposed well know U.S. best practices, yet far from being widely and cor- 
rectly implemented, we shall analyze the major traits of the major U.S. Authority acts 
and laws, which oblige organizations, companies and government agencies to abide to 
rules about Information Systems Security. 

3.3 Overview of Major U.S. Security Compliance Acts 

The Sarbanes-Oxley (SOX) act was enacted in 2002 as a US Federal Law to establish 
accounting and financial reporting standards and ethics to prevent scandals. In re- 
sponse to the Enron and WorldCom accounting scandals, the act placed stringent 
penalties on Chief Executive Officers and Chief Financial Officers in the event the 
people holding these positions breached the required trust and reporting mandates. 
The act was put in place to secure the benefits and trust of stakeholders and investors 
[54], Sections 302 and 404 of the act specifically describe the roles and duties of the 
Chief Information Officer and auditor and spell out the provisions of both internal 
security and accuracy of financial data. 

Alter conducted a survey to learn more about how companies perceive the SOX act 
and its perceived benefits to their businesses, value, and compliance [55]. Most of the 
companies agreed that they experienced business benefits from SOX compliance and 
that it does not distract them from their routine business work. Moreover, compliance 
with SOX improved their business processes, management, and accuracy of financial 
information and reporting systems. 

The Health Insurance Portability and Accountability Act (HIPAA) was enacted by 
the U.S. Congress in 1996 to safeguard the health interests of workers and their fami- 
lies in the event of job loss or change. The act requires health care providers, health 
care clearing houses, and health insurance agents to observe physical, technical, and 
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administrative duties and responsibilities while handling clients’ private, confidential 
electronic data [56]. In 2009 the Subtitle D of the Health Information Technology for 
Economic and Clinical Health Act (HITECH Act) enacted as part of the American 
Recovery and Reinvestment Act of 2009, addresses more privacy and security issues 
with respect to the electronic transmission of health information [57]. 

The Gramm-Leach-Bliley act [58] act came into existence in 1999 from the U.S. 
Congress. It prohibits the ability of insurance companies, investment companies, and 
commercial banks from merging into a single conglomerate. Moreover, it requires 
financial institutions such as mortgage lenders, debt collection agencies, and settle- 
ment services providers to protect the financial and non-public information of inves- 
tors from unauthorized access, disclosure, and use. Alter reports that organizations 
perceive benefits from both the HIPAA and the GLB acts even though IT spending 
has increased [59-60]. 

3.4 Growing Importance and Impact of Compliance 

For organizations that implement any kind of data security measures, compliance is 
often a major component that must encompass not only breaches to security but com- 
pliance with privacy laws and policies. In fact, the budget for compliance often 
exceeds the budget for programs [61-62], The importance of such compliance is un- 
derscored by the fact that internal data are often more valuable to an organization than 
its external transactions [63-64]. No well-run organization would risk non-compliance 
with laws thereby jeopardizing its trade and business secrets. If an organization is 
judicious, flexible, and consistent enough in monitoring and reviewing its compliance 
policies, it is likely to subject data and secrets to lower risk thereby decreasing 
security and compliance budgets over time. 

IT infrastructure is a term comprised of processes, staff, relations, technologies, 
and systems. When compliance includes all of these areas of an organization's IT 
infrastructure, the organization enjoys the following advantages: 

• Manual handling of data often results in errors and omissions. Automation and 
enforcement of security standards and compliance rules ensures responsiveness, 
speedy delivery, and secure actions [65]. 

• IS security is a continuous process and enforcing compliance standards allows IT 
managers to configure, change, improve, monitor, and upgrade security policies 
more easily. Compliance enhances this responsiveness and requires that the 
measurement of IS security is both possible and timely [32, 66]. 

• Resources such as time, money, effort, and information on personal, operations, 
and financial fronts can be optimized and saved from severe repercussions through 
a sound compliance policy [37, 46, 61]. 

• Compliance allows an organization to efficiently remedy non-complaint events. 
According to Alter, the growing significance of compliance in organizations is 
clear; compliance budgets doubled in just one year between 2005 and 2006 while 
organizations continually favor enforcement of the SOX and other acts [67], 
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4 Analyzing Compliance Behaviors in Organizations 

Extant literature suggests that most of an organization’s information security threats 
arise from the careless and negligent attitudes and behaviors of employees [23, 68- 
70]. When evaluating the behaviors of employees who choose either to comply or not 
comply with information security policies and procedures, there are several pertinent 
issues to consider [1, 71]. Attitude denotes an individual employee’s motivation and 
affect toward complying with security policy [72]. These are determined by his/her 
positive and/or negative feelings about the individual and organizational conse- 
quences of non-compliance. If an employee is motivated and possesses the willing- 
ness and ability to carry out specific compliance behaviors, the chances are greater 
that he/she will actually execute those behaviors [73-77], 

Delving a bit deeper into the threats arising from non-compliant behavior, recent re- 
search suggests that it is mostly the negligent attitudes of employees that places the or- 
ganization in serious risk of security breaches (78-79). These attitudes are the result of 
favorable or unfavorable employee perceptions toward employers or the organization as 
a whole; favorable perceptions lead to fewer instances of non-compliance [21-80]. 

According to Poneman’s 2009 study of security policies and employee compliance 
behaviors, most of the attrition in complying with security policies occurs when the 
organization fails to provide adequate training to employees [27]. This is a major 
drawback to when companies invest enormous amounts of money in planning policies 
and deploying infrastructure and technologies but fail to train the human asset that 
actually executes the organization's plans and strategies through employee expertise 
and knowledge. A second issue arises from policies being ineffective where organiza- 
tions plan and record strategies on paper with no serious thought about actual execu- 
tion. This is one reason why employees overlook the security norms and perform 
carelessly at times leading to ineffective policies and breaches in compliance that go 
unreported. 

Other reasons where organizations are at fault in making security compliance an en- 
terprise wide campaign occur when rules, policies, and regulations are too complex to be 
understood by employees [1]. Employees not able to grasp the real meaning and reason 
behind a compliance policy do not comply with, ignore, and/or violate the rules [55]. 
Adding to the inefficiencies, organizations often fail to enforce strictly the policies that 
protect information systems; they are much too lenient in executing and then governing 
the policies with which employees are already relaxed about complying [16]. The em- 
ployees often find ways to avoid penalties or punishments because the policies are not 
stringent enough and management, therefore, cannot enforce them [2, 30). 

Most employees are generally unaware that policies pertaining to security and 
compliance even exist within the organization [14, 39]. This is another major setback 
for the organization that aims to gain information security capabilities through com- 
pliance but fails at the preliminary step of communicating the policies to all channels 
of the organization. 

The Securities and Exchange Commission failed to resolve, as far as year 2008, 12 
over 20 information security weaknesses previously reported by the United States 
Government Accountability Office audit [81]. When we observe that in particular 
SEC failed to fully implement its Information Security Program (ivi, pages 12-14), 
given the importance in terms of World’s securities market stability, the pressure and 
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the high attention from authorities and banks on the matter, we cannot think of any 
other organization on the planet to be able to completely and easily succeed in 
implementing ISPs. 

5 Discussion 

As demonstrated, both employees and employers contribute to failed implementation 
of compliance policies administered by the organization [82]. Security compliance is 
not often made a critical function in most organizations because policy rather than the 
cognitions and behaviors of the employee are at the forefront of ensuring secure in- 
formation systems [8, 32, 83) and resources allocated for end user security awareness 
training are still inadequate in more then 50% of organizations, accordingly to a 
recent survey [84]. Taking this point as the foundation for the current state of infor- 
mation security compliance in organizations, the following research findings and 
recommendations are offered in order to appreciate the relationship between Com- 
pliance and ISP, where the two play reciprocally the drive and the dependent variable 
between each other. The research findings can be summarized as follows. 

• Compliance has shown the trait of a cultural force within the organization that has 
to be followed, naturally, by each and every level, even temporary employees. To 
have this be made effective, it’s appropriate making use of leadership within the 
organization [85]. 

• One of the biggest setbacks to compliance occurs when a new technology enters the 
market and the organization searches for appropriate policies and compliance stan- 
dards covering issues respective of the technology. Compliance policies work well, 
then, only if they are enough flexible and easily communicated to employees and 
managers, without losing control. This also means that, even when compliance is 
documented, non-compliance has to be clearly reported and recorded with accoun- 
tability and penalties levied when necessary. With this in mind compliance and data 
protection shall influence ISP to be an organization-wide initiative to make 
employees aware of training activities and the consequences of non-compliance 
[39], 

• Compliance can be compared to the organization’s security policy immune system. 
Without a structured and well-defined framework set up for guiding the com- 
pliance process, ISP can never contribute to the organization’s success. The 
compliance drive has to be made integral to the business processes and should pass 
down as an integral part of management strategies and governance programs [86]. 

In this regard, the present research results show the following propositions of the 
critical success factor and components of a compliance program. 

— Proposition 1 . After identification of applicable policies is complete, an appropri- 
ate, thorough, and judiciously-devised compliance plan should be drafted. This ISP 
then serves as a guide to the future actions, schedules, roles, duties, tasks, and mi- 
lestones to be achieved. Identification of available resources is also carried out 
while preparing the plan. In a compliance program, there are numerous roles and 
responsibilities to handle from the grass root level to the executive level. To ensure 
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that ISP diffuses through the managerial levels, it is of utmost importance to assign 
duties to relevant organizational officers. The board of directors, steering commit- 
tees, and audit executives are some of the positions that should accomplish the 
tasks of policy planning and actual implementation. 

— Proposition 2. Information assets are often the most important organizational re- 
source to maintain competitive advantages [18-19] and it is in the organization’s 
best interest [87-88] to enact an appropriate compliance policy to protect informa- 
tion system’s availability, confidentiality, and integrity [21 ]. Consequently, it is es- 
sential to determine which information and to what extent that information should 
be available to various process owners. This will result in effective identity authen- 
tication and avoidance of accidental or unintended repudiation of information to 
those who need it. 

— Proposition 3. To avoid risks, it is essential that organizations take on a proactive 
approach when assessing the magnitude of and risk probability of threat occurrence 
that includes impact analysis. This helps determine the intensity of loss or damage 
that could occur if employees and managers do not comply with ISP. Risk assess- 
ment and impact analysis strengthen the urgency of adhering to the compliance 
program. While analyzing risk, three categories emanate from the literature: 
physical risk including protection of media, hardware, facilities, and tangible 
components; technical risk involving vulnerability to configuration and network 
architecture; and administrative risk arising from effectiveness in management, go- 
vernance of policies, and procedures and efforts to comply with the existing 
standards [38, 41, 56]. 

— Proposition 4. Control measures should be in place to judge how much of the road 
to compliance has been traversed and how much is left. In addition, performance 
scales, shortcomings, and what can be done to improve on the compliance policy 
should be considered at regular intervals. These control measures must be updated 
to stay in line with current IT practices and ahead of expected, near-future changes. 
Failure to comply with established rules and policies can occur if knowledge about 
staff, employees, and managers implementing the security policy is unknown. In 
such situations, only pre-planning can save the organization through appropriate 
education and training imparted to those responsible for information security com- 
pliance. If everyone is abreast of the latest compliance trends, they can encourage 
others to follow them. 

— Proposition 5. Security and compliance are ongoing rather than static programs and 
keeping in mind the ever changing nature of technology, it is obvious that many of the 
additions and changes to ISP will end up as ineffective over time. Consequently, or- 
ganizations must perform frequent monitoring of current practices, assess suitability of 
the security policy with the current practice, and implement modifications. 



6 Limitations 

A limitation of this work is related primarily to the methodology used, i.e. conceptual 
analysis and no empirical data analysis. This research concludes with the theoretical 
foundation and hypothesis for an eventual empirical research. Conceptual analysis 
defined by Jarvinen [89-90] is, although, acceptable for IS research. The objective and 
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the general questions have been then approached with the mentioned conceptual anal- 
ysis and the hermeneutic circle, both used to infer a meaning not explicitly expressed 
in the original literature [91-92], Some authors like Cole and Avison [93] commented 
about hermeneutics in IS research, as “hermeneutics is neither well accepted nor 
much practiced in IS research ”, while others, like Siponen [29] are quite favorable. 

It is foreseen a further empirical investigations and data analysis to validate 
conceptual analysis findings of this research. 
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Abstract. A perception gap or misunderstanding between different 
groups/stakeholders is one of the most common reasons for the difficulties in 
many real world problems, such as multi-organizational coordination, risk 
communication, and service matching and satisfaction. Before trying to solve 
such problems, however, it is necessary to focus more on the perception gap it- 
self. In this paper we propose a model based on the concept of mutual belief 
that describes the perception gap between different stakeholders, as well as a 
model-based methodology for quantifying and bridging the gap. Using cross- 
cultural communication between international and Japanese students as a case 
study, we show the applicability and validity of our proposal. Through the case 
study, we have confirmed that it is possible to identify different types of gaps 
using the model, and moreover, that some gaps can be reduced by the proposed 
method. 

Keywords: cross-cultural communication, perception gap, expectation and belief. 



1 Introduction 

Many difficult real-world problems such as multi-organizational coordination, risk 
communication, cross cultural communication, and service matching and satisfaction, 
rely on different stakeholders. A perception gap or misunderstanding between these 
different stakeholders is considered to be one of the most common reasons that these 
real world problems are so difficult. To date many studies have addressed such gap 
problems in a variety of fields. In the service research domain, for example, Zeithmal 
et al. (1990) proposed a model categorizing four different types of gaps in the service 
process and developed a method called SERVQUAL to measure service quality in 
terms of the gap between service expectations and perceptions. There are also many 
studies on the gaps in medical communication. For example, Awad et al. (2005) iden- 
tified that undesirable team performance in operating rooms was due to poor commu- 
nication or gaps in the communication among surgeons, anesthesiologists, and nurses. 
To improve communication, a dedicated training session using the crew resource 
management (CRM) principles was conducted and its effectiveness confirmed. These 
studies have identified where gaps exist in multi-stakeholder processes and provided 
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some categories of perception gaps. However, they have not provided any frame- 
works or formulations for describing the gap itself. Moreover, existing methods to 
reduce gaps between different stakeholders do not have a theoretical basis, but are 
based mainly on empirical approaches like CRM. There are therefore two objectives 
in this study. One is to propose a model to provide a formulation for the gap itself. 
The concept of mutual belief is adopted as a fundamental assumption to describe the 
gap between different stakeholders. The other is to propose a method based on the 
proposed model to bridge the existing gaps between different stakeholders. In the next 
section, a model based on the concept of mutual belief is proposed. In Section 3, a 
method to reduce the gap as well as one for quantification and calculation are pro- 
posed and tested through a case study of cross-cultural communication. An iterative 
questionnaire based method for bridging the gap is developed. In quantifying the gap, 
a Likert scale and fuzzy set theory are adopted. In Section 4, the results obtained in 
the case study are presented, together with a discussion thereof, followed by the 
conclusions in Section 5. 



2 The Proposed Model 

2.1 Mutual Beliefs in Expectation and Belief 

The concept of mutual beliefs is introduced here as the foundation of the proposed 
model. The ability to infer or estimate the status of the mind of others is believed to 
be innate and essential for our sociality. One of the characteristics of this ability is 
that we can infer the other person’s mind recursively. This recursive characteristic can 
also be found in generating expectations and beliefs between different persons. We 
therefore model it using a structure of mutual belief based on the philosophical study 
of team intention and collective intention (Tuomela and Miller 1987, Bratman 1992). 
In the dyadic case (Agents A and B), these mental constructs can be formalized as: 

EXP(A, tp )/ EXP(B, ip) = A/B’s expectation of cp. 

BEL(A, tp )/BEL(B, tp) = A/B’s belief in cp. 

BEL(A, BEL(B, cp))/BEL(B, BEL(A, tp)) = A/B’s belief in BEL(B, cp)/BEL(A, tp). 



Mutual beliefs are hierarchically justifiable such as those between the second and 
third BEL. A mutual belief is theoretically ad infinitum; however, in actual practice 
only two or three may be sufficient. In this article, therefore, we describe a model 
with a maximum of three levels. In the above, A and B represent stakeholders and ip 
represents the target of the expectation. EXP and BEL denote, respectively, the expec- 
tation and belief. When more than one stakeholder is involved, a gap or conflict 
emerges between the corresponding mental constructs, such as between EXP(A, tp) 
and BEL(B, EXP(A, cp)) as shown in Table 1. In this formulation, the self-expectation 
of oneself can also be described as EXP(A, A) or EXP(B, B). 
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Table 1 . Relationship between Expectation and Belief 



Expectation 


Target cp 


Target cp 


A 


- 


Exp(A, ip) 


B 


EXP(B, (p) 


- 



Belief 


To A 


ToB 


A 


- 


BEL(A, EXP (B. tp)) 


B 


BELfB, EXP (A, tp)) 


- 



2.2 Will and Should Expectations 

Boulding et al. (1993) suggested that there are two different types of expectations: 
should and will expectations. According to their definition, will expectations are 
formed by customers about what will happen at their next service encounter. This is 
consistent with the expectations-as-predictions standard often used in customer 
service literature, with the expectation mostly affected by past service experiences. 
Should expectations, on the other hand, are formed by customers about what should 
happen at their next service encounter; in other words, what customers feel they 
deserve. The model in this study incorporates the idea of these different classes of 
expectations. However, we have modified the definitions to fit in with this study, 
which does not focus only on the service industry. 

2.3 Mental Constructs of the Proposed Model 

Given below is a complete formalization of the proposed model, created by integrating 
the two theories discussed above. For later application and analysis, the formalization of 
each mental construct is provided in the form of a proposition. 



• EXP wiU (n, A, By. a is a will expectation of stakeholder A with respect to 
stakeholder B. 

• EX P should ( |3, A, B): |3 is a should expectation of stakeholder A with respect to 
stakeholder B. 

• BEL(A, EXP W in (a, B, A)): stakeholder A holds the belief that stakeholder B has a 
will expectation a of him/her. 

• BEL(A, EXP should ((3, B. A)): stakeholder A holds the belief that stakeholder B has a 
should expectation (3 of him/her. 

• EXP wi u(a, A, A): a is a will self-expectation stakeholder A has of him/herself. 

• EXP should ( j3. A, A): (3 is a should self-expectation stakeholder A has of him/herself. 
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A= { ail EXP(a;, x, x) = true } 

B= {bjl EXP(bj, y, x) = true} 

C={c k l BEL(x, EXP(c k , y, x)) = true} 



(i) 


A n B n c 


(v) 


A n — iB n — iC 


(ii) 


A n B n -iC 


(vi) 


— iA n — iB n c 


(ill) 


A n -iB n c 


(vii) 


— iA n B n — iC 


(iv) 


-iA n B n c 


(viii) 


— iA n — iB n — iC 



Fig. 1. Different Modes of Gaps 



Table 2. Contextual Meaning of Each Gap Type 



No. 


Situation 


Possible Perception Gap 


(i) 


Subject is aware of the expectation of a different 
stakeholder, and has the intention of responding to it. 


No perception gap. 


(ii) 


Subject is not aware of the expectation of a different 
stakeholder, but feels obligated to comply. 


Implicit effort. 


(hi) 


Subject expects him/herself to respond to a non-real 
expectation of a different stakeholder. 


Being a busybody. 


(iv) 


Subject is aware of the expectation of a different 
stakeholder, but does not feel obligated to comply. 


Have different opinions and 
cannot reach an agreement. 


(v) 


Subject knows he/she is not expected to comply, 
however, feels he/she should do so. 


Has a high standard of self- 
discipline. 


(vi) 


Subject believes there is an expectation of a differ- 
ent stakeholder, although this is not so. He/she does 
not, however, feel obligated to comply. 


Misunderstanding. 


(vii) 


Subject is not aware of a different stakeholder’s 
expectation, and does not feel obligated to comply. 


Unrequited love. 


(viii) 


No expectation exists, subject does not consider 
there to be an expectation of him/her, and does not 
feel obligated to comply. 


No gap. 



3 Case Study 

We used the perception gaps in cross-cultural communication between international 
and Japanese students at a Japanese university as a case study to apply the proposed 
model and methods. A series of questionnaires was developed to elicit each group’s 
expectations of the other group. The questionnaires are iterative in that they comprise 
two rounds, where the results of the first round are released in the second round. An 
overview of this process is illustrated in Figure 2. To analyze the collected answer 
data, a method to quantify and calculate the gap has also been developed. In the 
following subsections, further details are given about each questionnaire and the 
methods. 
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Fig. 2. Overview of the Series of Questionnaires 

3.1 The First Questionnaire 

The purpose of this questionnaire is to collect the expectations of both international 
and Japanese students of each other. The questionnaire begins with an open question 
asking each subject to list five expectations he/she has of the other group. Then each 
subject is asked to answer the two questions below about each expectation: 

1. To what extent do you think international/Japanese students WILL do this? 

2. To what extent do you think international/Japanese students SHOULD do this? 

The subjects are asked to answer the above questions according to the Likert-scale, 
where 0 denotes “totally disagree” and 10 “totally agree”. These questions are used to 
distinguish different classes of expectations. In the first round, 21 international and 20 
Japanese students participated. 

3.2 The Second Questionnaire 

The purpose of the second questionnaire is to inform international/Japanese students 
what is expected of them by their counterparts, as well as to evaluate the will and 
should expectations of the other group. First, the answers collected in the first ques- 
tionnaire are summarized into various items; 20 (cq, 1 < i < 20) and 21 (/?;, 1 < i < 
21) were summarized as the expectations of Japanese and international students, re- 
spectively. Second, the following two stages are undertaken. In the second round 
questionnaire, 55 international and 56 Japanese students participated. 

Stage 1 

The questionnaire is presented in the form of a table. In this stage, the subjects are 
told that the items listed in the table are merely possible expectations of their counter- 
parts. Then they are asked to answer the following two questions about each 
expectation according to the previously defined Likert-scale. 

3. To what extent do you think you WILL do this? 

4. To what extent do you think you SHOULD do this? 
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The Second Stage 

After the first stage, the subjects are informed that the items listed are actual expecta- 
tions of their counterparts. In this stage, the averages of the degree of will and should 
expectations obtained in the first questionnaire are also presented with the list. The 
subjects are then asked to answer the following three questions: 

5. How surprised were you when seeing the average score of your counterparts for 
“to what extent do you think they WILL do it”? 

6. How surprised were you when seeing the average score of your counterparts for 
“to what extent do you think they SHOULD do it”? 

7. After reading the opinions of your counterparts, please answer again “to what 
extent do you think you WILL do it?” 

3.3 Quantification and Calculation 

Each mental construct elicited by the above seven questions was quantified between 0 
and 10 on the Likert scale. This value can be assumed to be the degree of belonging- 
ness ([0, 1.0] to the corresponding mental construct. Once the value is obtained, we 
can apply fuzzy set theory to calculate the belongingness of each item to the gap types 
listed in Figure 1 and Table 2. In other words, we can infer which gap type is most 
probable for each expectation. All the mental constructs obtained by the questions are 
summarized in Table 3. 



Table 3. Mental Constructs Elicited by Each Question 



Question 

No. 


Mental Constructs 


Details 


1 


EXP W iii(a, A, B) 


1st round will expectation 


2 


EXP Shoki (n, A, B) 


1st round should expectation 


3 


EXP wm (a, A, A) 


1st round will self-expectation 


4 


EXP S hoid(a, A, A) 


1st round should self-expectation 


5 


BEL(A, EXP W m((3, B, A)) 


1st round belief on will expectation 


6 


BEL(A, EXP Should ({3, B, A)) 


1st round belief on should expectation 


7 


EXPwm(a, A, A) 


2nd round will self-expectation 



Gap Calculation 

It is reasonable to assume that if there is a lesser perception gap between two agents 
or stakeholders, the degree of belongingness of each mental construct to the center 
region (i) increases. To assess this similarity, we calculated the norm of the vector I = 
{ao, a! ..., a,}, where a, is the degree of belongingness of a mental construct to 
AnBflC. This norm is expected to represent the similarity or agreement in expecta- 
tions and beliefs between two agents/stakeholders, which means that the bigger the 
norm is, the lower is the possibility that a perception gap exists. It is also expected 
that the two agents/stakeholders with the biggest norm toward each other are the best 
match. This calculation can be applied to different units of stakeholders like 
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individual-individual, individual-group, or group-group, if corresponding questions 
are prepared. In this paper, however, only the individual-group gap was calculated to 
demonstrate the matching process. 

4 Results and Discussion 

In this section, several results obtained through the case study are presented and 
discussed. 

4.1 Gap Quantification 

Figure 3 shows the calculated values of the expectation of the Japanese students to- 
ward international students, to “study Japanese culture and understand it”. This value 
is the average of all the participants, that is, it represents the group-group gap. In this 
case the value (0.77) in region (i) is the highest, which suggests that this expectation 
is highly acknowledged by both international and Japanese students. The regions with 
the lowest value (0.16) indicate that these types of gap are not likely to occur for this 
expectation. In general, the results of the gap quantification seem consistent with 
empirical predictions such as the case shown in Figure 3. One interesting finding is 
that both Japanese and international students had higher should expectations than will 
expectations, which could mean that both sides are better matched in their ideal 
model, and less in reality. 




Fig. 3. Example of Gap Quantification 

4.2 Modification of Self-expectation 

By comparing the will self-expectation in the first round and that in the second round, 
we assessed whether there was a modification in the students’ attitude to cross- 
cultural interaction. We evaluated the difference in the average values of each item 
between the first and second rounds, and confirmed that there was a significant differ- 
ence (p = 0.018 < 0.05) in the attitude of Japanese students, although no significant 



122 



T.-H. Chou, T. Kanno, and K. Furuta 



difference (p = 0.78) was found in that of international students. One reason for this 
could be that the average of the first round self-expectation of international students is 
already high enough and there is not much room for improvement. On the other hand, 
Japanese students could be less confident in responding to the expectations of interna- 
tional students in the first round, before being informed of the actual expectations. In 
the second round, however, they were inspired to modify their self-expectations to 
meet the expectations of their counterparts. This result suggests that the iterative ques- 
tionnaire is effective, at least with respect to Japanese students, in bridging the 
perception gap between the student groups. 

4.3 Best Matching 

Table 4 shows the best matched student with respect to the other group from the 
viewpoint of different types of expectations. It can be said that those for will expecta- 
tions are practically best and more typical, while those for should expectations are 
ideally best. The results show that there is no overlap in the best results for will and 
should expectations, which implies that there is a gap between the ideal and real ex- 
pectations of the participants in this case study. It also turns out that Subjects #20j and 
#37j have rich experiences of living overseas (#20j: 2 years in UK; #37j: 5 years in 
UK, 8 years in France and 1 year in US). This provides a partial proof of the validity 
of the method. 



Table 4. Results of Matching 





Best int’l student for 
JPN students 


Best JPN student for int’l 
students 


Will Expectation 


#25: 


#20j 


Should Expectation 


#42: 


#37j 


Will Expectation 

(2nd round) 


#40! 


#8j 



4.4 Comments from the Participants 

Many of the participants found this questionnaire interesting and quite different from 
other similar surveys. Furthermore, many international students mentioned that this 
questionnaire gave them a good opportunity to reflect on what Japanese students 
expected of them, which they had never thought about before. An international 
student said after the questionnaire: "When I first came to Japan, I was full of 
enthusiasm and was eager to make Japanese friends. After a while, however, I started 
to hold back little by little, maybe it was because of the cold response I got time to 
time, or it was simply because I got tired. Your questionnaire made me think for the 
first time what they want from us, and I started to do some introspection. Now I want 
to try to put in more effort to make friends with them again.” 

These comments confirm that this method is not only a questionnaire to elicit the 
perception gap, but also an effective support in reconsidering relationships with other 
parties and pursuing better mutual interaction. 
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4.5 Application in the Service Industry 

The results presented in this paper were obtained within the context of cross-cultural 
communication between international and Japanese students. Nevertheless, both this 
model and method are expected to be applicable to other contexts in different 
domains, because the essential structure of the gap problem is common and universal. 
One of the possible application domains is the service industry. In the service 
industry, there are mainly three different stakeholders; an employer, employees, and 
customers, with various problems between them. For example, an employer would 
want to know whether the employees really understand the meaninig of his/her 
directives and share the same vision about the service. In another case, for smooth 
team cooperation and task allocation within a company, it is believed to be necessary 
to establish a shared mental model about the service and team work between 
employers (Kanno et al. 2011). Moreover, it is absolutely crucial to know 
the customers 1 visions and expectations about the service and reduce the gap between 
the actual service in order to enhance the productivity of the service. One of the 
advantanges of our model is that each different kind of perception gap can be placed 
in the model shown in Figure 1 and more detailed explanations about the current 
situtaion can be provided. For example, gap (iii) in Table 2 means that the efforts of 
the company are useless and may be wasteful of energy and resources. 

Gap (vi) means that the customers’ needs have gone unheard and it is very likely 
that the customers will turn to other service providers. Gap (v) represents the type of 
service provider that offers a high quality of service and is more likely to be 
successful. If the gap falls into type (iv), it means that the service provider and 
customer are totally mismatched; such a customer is not the service provider’s target 
and the service provider cannot satisfy the customer at all. 



5 Conclusions 

In this study, we proposed a model to describe the perception gaps between different 
groups/stakeholders in terms of expectations and beliefs. We also proposed a model- 
based method for identifying and bridging the gap, that is, an iterative questionnaire 
that repeats elicitation and presentation of expectations and beliefs of the other party. 
This method was applied to a case study of cross-cultural communication between 
international and Japanese students at a Japanese university. The case study con- 
firmed that the method is applicable to and easy to use in an actual problem. A 
comparison of the first and second round results in self-expectation suggests that the 
iterative process is effective in modifying the attitude toward the expectations of the 
other party. It is also suggested by the comments of the participants that the proposed 
method encouraged them to see themselves from the viewpoint of their counterparts 
and thus is effective in bridging the gap. Further investigation is expected to show 
the validity and reliability of the proposed model and method; however, the results of 
the case study are promising and our proposal is expected to contribute to solving the 
problems arising from the perception gap between different groups/stakeholders. 
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Abstract. Present day enterprises often become service-oriented enter- 
prises, which are comprised of a dynamic network of organisations that 
collectively provide services. These services express stakeholders’ needs, 
and can be viewed from different perspectives. In this paper, we con- 
sider value web and enterprise architecture perspectives. Specifically, we 
present a step-wise mapping approach that integrates the value mod- 
elling technique e 3 value into the enterprise architecture language Archi- 
Mate. The main contribution of this paper is twofold. First, we present 
our initial arrays into how to bridge between e 3 value and ArchiMate 
and, in doing so, we show how these modelling techniques complement 
one another. Second, by reflecting on the bridging between e 3 value and 
ArchiMate, we discuss the limitations of our integration, which provides 
useful input for future efforts into model integration. We illustrate our 
approach by means of a case in the insurance domain. 

Keywords: enterprise architecture, value web, ArchiMate, e 3 value, model 
integration. 



1 Introduction 

Enterprises need to negotiate many challenges, such as changes in the economic 
climate, mergers, acquisitions, novel technologies, et cetera. As a result, enter- 
prises need to be agile to improve their chances of survival. Moreover, the shift 
towards a services oriented economy makes it even more important for enterprises 
to adopt themselves to changes. Present day enterprises often become service- 
oriented enterprises, which are comprised of a dynamic network of organisations 
that collectively provide services JXJ • 

Dealing with such changes requires a good steering instrument. Such a steer- 
ing instrument should provide enterprises with the ability to analyse the current 
state of the enterprise, identify and describe alternative future states, guard 
the cohesion and alignment between the different aspects of an enterprise such 
as business processes and their ICT (Information and communications technol- 
ogy) support. Enterprise architecture is generally considered to provide such a 
mechanism for cohesive steering (2EEJ. It aims to provide management with 
appropriate indicators and controls to steer the transformation of an enterprise 
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into the desired direction. As such, enterprise architecture is concerned with the 
enterprise as a whole and not just enterprise-wide ICT architecture. 

Although the value of architecture has been recognized by many organisa- 
tions, mostly separate architectures are constructed for various organisational 
domains which remain unspecified or implicit |5J . In general, business models fo- 
cus on the service value generated by a business, whereas enterprise architecture 
models show how a business realizes these services J5jj . Ensuring integration be- 
tween the conceptual models representing the different stakeholder perspectives 
is a research problem. First and foremost, such a model integration is needed 
to ensure consistency. Different modelling techniques emphasize different per- 
spectives on the same system, and so should be in line with one another 8j ■ As 
such, model integration fosters traceability. For example, considering parts of an 
organisation modelled in one perspective, such as from a value perspective the 
actors exchanging value, it may return in another perspective, such as, from an 
ICT perspective, the actors exchanging messages. 

In this paper we present our first arrays into integrating, on a syntactic level, 
two conceptual models: e 3 value, for modelling a value perspective on the busi- 
ness at hand, and ArchiMate, for modelling business operationalization (such as 
business processes and the underlying ICT realizing the business collaboration) . 
It makes sense to look specifically at integrating e 3 value into ArchiMate: Archi- 
Mate has recently been adopted by the Open CroupQ as a standard for modelling 
enterprise architectures, but, as we shall see in this paper, lacks expressivity for 
modelling an enterprise from a value perspective. 

To the best of our knowledge, only || have so far considered specifically 
the integration of e 3 value and ArchiMate. However, while |5 do argue that 
ArchiMate complements e 3 value in terms of profitability calculations, little effort 
is made to show exactly how to bridge the two modelling techniques, and what 
the limitations in such a mapping are. More specifically, while 0P-8] do provide 
a mapping between the lvalue and ArchiMate metamodels, they leave implicit 
the actual use of this mapping to translate an e 3 value model into ArchiMate 
and vice versa. Worse still, [5] fail to discuss the conceptual differences between 
the e 3 value and ArchiMate metamodels, thus leaving for example implicit that 
e 3 value and ArchiMate interpret the concept of an “Actor” differently. However, 
ArchiMate concepts sometimes have no place in a e 3 value model and vice versa. 
For example: an IT-department that is not profit-and-loss responsible may be 
modelled as an Actor in ArchiMate but, because it is not interesting from a value 
perspective, should not be present in an e 3 value model. 

Note that in this paper, we present an initial mapping of e 3 value and Archi- 
Mate on a syntactical level. As such, the contribution of this work is twofold: 
(1) to provide an initial mapping between the value modelling technique e 3 value 
and the enterprise modelling technique ArchiMate. In this mapping, we show 
how e 3 value and ArchiMate complement one another, and (2) following up on 
that initial mapping, to point out differences between the two modelling tech- 
niques from both syntactic and semantic levels, which provides useful input for 
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further model integration. We use a running example of an insurance scenario 
to illustrate our ideas. 

The remainder of this paper is organized as follows. Section 2 introduces 
the insurance case study. In section 3, we discuss the integration of ArchiMate 
and e 3 value models. In particular, we show how ArchiMate operationalizes a 
value web modelled in e 3 value, and how e 3 value can be used for profitability 
calculations of an operationalization modelled in ArchiMate. Section 4 points 
out the initial mapping of our approach and discuss functionalities and limits of 
such integration. Section 5 presents related work. Section 6 concludes. 

2 The Archinsurance Value Web 

For illustration purposes, we present a fictitious but realistic insurance case. 
This case is inspired by a paper on the economic functions of insurance inter- 
mediaries 0, as well the running insurance case that illustrates the ArchiMate 
language specification jSIDj . In this section, we first use our insurance case to 
introduce the value modelling technique e 3 value (Sect. 12 .11) . Subsequently, in 
Sect. 12.21 we discuss the particular insurance case scenario that will be used as 
a running case for the remainder of this paper. 

2.1 Modelling the Archinsurance Value Web in e 3 value 

Archinsurance, a large insurance company, offers one of its many products, car 
insurance, directly to its customers via the internet and its sales representatives. 
The reason for selling directly to customers is mainly to cut costs that come with 
an intermediary, such as premiums paid and additional administrative costs. 
These cost cuttings, in turn, can be passed on to the customer in terms of a 
lower insurance fee. 

We use e 3 value to model this direct-to-customer sales model, e 3 value focuses 
on modelling the value exchanges between actors participating in a value web, 
depicting what each actor offers to others, and what it receives in return. The 
principle of economic reciprocity, which states that an offering from an actor 
should always be compensated, is central to e 3 value: in other words, one good 
turn deserves another. 

This Archinsurance direct-to-customer business model is depicted in the 
e 3 value model in Fig. |T| Here, we see that: 



— A customer (modelled as a market segment) provides his ‘complete risk pro- 
file’ to Archinsurance, which is valuable to the Archinsurance (an actor) 
since it defines the basis for the offered insurance package and its associated 
fees. 

— Archinsurance transforms the risk profile in an insurance offering via ‘Con- 
tracting’ (a value activity), and the customer receives a car insurance from 
Archinsurance in return. 
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Observe here the economic reciprocity, as modelled by a value interface in 
e 3 value: Archinsurance only provides its car insurance if it receives in return 
another valuable object: a complete risk profile. 





Legend 

Fig. 1. Value model of direct sales of car insurance 



2.2 Archinsurance: Moving from a Direct-to-Customer to an 
Intermediary Sales Model 

Archinsurance finds that its direct-to-customer model brings with it also the 
problem of adverse selection of risk profiles (cf. [7]). This adverse selection means 
that Archinsurance offers customers a car insurance against an inappropriate fee, 
or worse still, offers a customer a package that may in fact not be issued, because 
of an incomplete or faulty risk profile on the part of the customer. This is mainly 
due to a problem of information asymmetry: the customer knows more about 
his risk profile than the insurer does. For instance, customers knows more about 
their past accidents, or medical history. However, due to a lack of expertise or 
on purpose, customers do not always provide the necessary risk profile to the 
insurance provider. 

To reduce the risk of receiving incomplete customer profiles, Archinsurance 
considers moving towards selling insurances via an intermediary (see Fig. 0). 
The rationale for introducing an intermediary, and how this can be beneficial for 
all parties involved, are explained as follows: 



— The customer provides ‘personal information’ to the intermediary, which is 
valuable to the latter because it allows for the composition of a complete 
risk profile. 

— Using the value activity ‘Create customized insurance package’, the interme- 
diary matches customer information to appropriate offerings, and possibly 
requests additional customer information. Note that the value model shows 
only the (high level) value-adding activities: it can be detailed in an opera- 
tional ArchiMate model afterwards (see Sect. 18.21) . 
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— The intermediary provides Arclrinsurance with a ‘Complete risk profile’, 
which, as discussed, the insurer may use to mitigate adverse selection of 
risk profiles. 

— In return for the profile, Archinsurance pays the intermediary a premium. 

— The customer receives a ‘Tailored car insurance guarantee’ from the inter- 
mediary, and the actual ‘Car insurance’ from Archinsurance in return. This 
is to depict the advantage that, through intervention of the intermediary, 
the customer receives an insurance package in line with his profile, against 
an appropriate fee. 




Fig. 2. Value model of car insurance sales via an intermediary 



3 Towards Integrating ArchiMate and e 3 value 

We now show our approach for mapping between ArchiMate and e 3 value , using 
the baseline e 3 value models defined thus far as input. 

We first briefly introduce the enterprise architecture modelling technique 
ArchiMate (Sect. mi . Thereafter, we discuss how to map a e 3 value model to an 
ArchiMate model (Sect. Id. 21) and, vice versa, how to map an ArchiMate model 
to e 3 7;a(Me(Sect. 13,31) . 

3.1 Modelling an Enterprise Architecture in ArchiMate 

We rely on the ArchiMate modelling language to model the enterprise ar- 
chitecture of the Archinsurance case. ArchiMate has been transferred to the 
Open Group, where it is slated to become the standard for architectural de- 
scription accompanying the Open Group’s architecture framework TOGAF fIJ. 
ArchiMate focuses on administrative sector, unlike UPDM (Unified Profile for 
DoDAF/MODAF) whose main focus is the defense sector [TTij . ArchiMate is 
geared towards “Information processing dominant organisations” such as banks, 
insurance companies, government agencies, et cetera Cl . In this paper, it offers 
a coherent description of the enterprise architecture to enable communication 
among stakeholders, and to guide change processes within Archinsurance. 
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3.2 e 3 value to ArchiMate: Operationalization of a Business Scenario 

For the direct-to-customer value web in Fig. ^ we provide an enterprise archi- 
tecture in Fig. [3 From e 3 value we arrive at this enterprise architecture modelled 
in ArchiMate in two steps: 

1. Concept Inheritance from e 3 value to ArchiMate: We find that actors 
and, in particular, business functions, provide a bridge between e 3 value models 
and ArchiMate models. Actors and market segments in e 3 value become actors 
in ArchiMate. In the Archinsurance case, the actors ‘Customer’ and ‘Archinsur- 
ance’ from the e 3 value model (Fig. EJ become actors in the ArchiMate model 
(Fig. ED. Value activities in e 3 value become business functions in ArchiMate. 
In the Archinsurance case, the value activity ‘Contracting’ becomes a business 
function in the ArchiMate model. Finally, given a e 3 value model wherein actors 
execute value activities, we can relate business functions to actors in ArchiMate. 
In the Archinsurance case, we see that Archinsurance executes the value activity 
‘Contracting’ and so can link in ArchiMate ‘Contracting’ to the relevant business 
actor (i.e., Archinsurance). 

2. Operationalization of Business Functions in ArchiMate: We find that 
business functions, which in ArchiMate denote the high-level functions that a 
company executes, provide an excellent starting point for modelling operational 
details. For example, we detail exactly what operational business process steps 
realize the business function ‘Contracting’: the steps ‘Registration of customer 
profile’, ‘Eligibility check’ and ‘Estimate monthly customer fee’. Subsequently, 
we can use these business process steps to model the required ICT support in 
ArchiMate. For example, the enterprise architecture that realizes the direct-to- 
customer scenario, we see that the IT service ‘Customer administration service’ 
is required for the registration of a customer profile, and that a ‘Risk assessment 
service’ is required for the eligibility check and the estimation of the monthly 
customer fee (see Fig. ED- Finally, note that ArchiMate allows for also modelling 
the physical ICT infrastructure required to run said ICT-applications. Due to 
space restrictions however, we do not show this physical infrastructure. 

In ArchiMate, a layered view provides a natural way to look at service-oriented 
models. Services define externalized functionality from one layer that is useful in 
another layer. This shows the service-orientation of ArchiMate: no matter what 
changes in a layer (e.g., business or application), the services offered from one 
layer to another remain the same. 

Note that the details discussed regarding the operational business process 
steps, applications and physical infrastructure are especially useful for cost esti- 
mation of an ICT infrastructure (see Sect. 13. 3|) . Moreover, it is important to note 
here is that value objects, which e 3 value uses to show the economic rationale for 
actors to participate in a value web, are not carried over to ArchiMate. We return 
to this point in our reflection on mapping e 3 value to ArchiMate (Section ED- 



